{ "analysis_id": "1c2e6d58-c62a-4009-939b-3aa82de281a2", "session_id": "d882ee83-1604-4cbb-b09b-1739d1fdb5a8", "status": "completed", "filename": "2019-08-20-traffic-analysis-exercise.pcap", "source_sha256": "500da44cbb442f282549a28815bec1dc55e6c0120286c532c43f8dd4a8c5d94d", "source_size_bytes": 13244754, "schema_version": "pcap-analysis-v1", "semantic_sha256": "5dd91a89918e17e233f059f813a3ad75e87ad19e9200974e28e6d937749daa60", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 18943 packets across 29 IP endpoints and 248 transport flows. Observed 102 DNS events, 28 HTTP requests, 56 TLS ClientHello events, and 21 recovered file/message object(s). Deterministic rules produced 8 finding(s): 1 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-08-20-traffic-analysis-exercise.pcap\nCapture SHA-256: `500da44cbb442f282549a28815bec1dc55e6c0120286c532c43f8dd4a8c5d94d`\nSemantic result SHA-256: `5dd91a89918e17e233f059f813a3ad75e87ad19e9200974e28e6d937749daa60`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 18943 packets across 29 IP endpoints and 248 transport flows. Observed 102 DNS events, 28 HTTP requests, 56 TLS ClientHello events, and 21 recovered file/message object(s). Deterministic rules produced 8 finding(s): 1 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 18943\n- Duration: 2266.867922 seconds\n- Captured bytes: 12941642\n- Endpoints: 29\n- Flows: 248\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 3251 / TCP stream 72, frame 3253 / TCP stream 72.\n\nMetrics: `{\"content_type\":\"text/html; charset=iso-8859-1\",\"declared_body_bytes\":276,\"destination\":\"10.8.20.101\",\"response_count\":1,\"source\":\"206.189.74.47\",\"uri\":\"/wp-content/uploads/2019/08/3antifreeze.rar\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 12669 / TCP stream 130, frame 13445 / TCP stream 130.\n\nMetrics: `{\"content_type\":\"application/rar\",\"declared_body_bytes\":753229,\"destination\":\"10.8.20.101\",\"response_count\":1,\"source\":\"68.183.185.221\",\"uri\":\"/wp-content/uploads/2019/08/antifreeze.rar\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 247 / TCP stream 17, frame 249 / TCP stream 17, frame 251 / TCP stream 17, frame 253 / TCP stream 17, frame 537 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.8.20.8\",\"event_count\":14,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.20.101\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 44 / TCP stream 2, frame 84 / TCP stream 2, frame 91 / TCP stream 2, frame 93 / TCP stream 2, frame 152 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.20.8\",\"event_count\":397,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.8.20.101\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 248 / TCP stream 17, frame 250 / TCP stream 17, frame 252 / TCP stream 17, frame 254 / TCP stream 17, frame 538 / TCP stream 17.\n\nMetrics: `{\"destination\":\"10.8.20.101\",\"event_count\":14,\"operation_numbers\":[\"0\",\"1\",\"12\"],\"protocol\":\"drsuapi\",\"source\":\"10.8.20.8\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 46 / TCP stream 2, frame 89 / TCP stream 2, frame 92 / TCP stream 2, frame 95 / TCP stream 2, frame 154 / TCP stream 11.\n\nMetrics: `{\"destination\":\"10.8.20.101\",\"event_count\":386,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,4,4,4,4,4,4,4,4,4,4,19,19,19,5\",\"4,4,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.8.20.8\"}`\n\n### HIGH — Credential-shaped records in a cleartext HTTP request\n\nThe decoded request body contains a credential-record structure or private-key marker. Values are redacted from derived evidence. This proves transmission of the observed structure, not that a credential is valid or how it was obtained.\n\nRule: `sensitive-data-in-cleartext@pcap-rules-v5`; confidence: 0.95; evidence: frame 7772 / TCP stream 87.\n\nMetrics: `{\"body_sha256\":\"351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15\",\"body_size_bytes\":259,\"destination\":\"170.238.117.187\",\"secrets_redacted\":true,\"source\":\"10.8.20.101\"}`\n\n### MEDIUM — System-inventory structure transmitted in HTTP body\n\nA request body contains process/system inventory markers and may include host/account assertions. This is network-observed transmission, not proof of the commands having executed on that host.\n\nRule: `system-inventory-upload@pcap-rules-v5`; confidence: 0.9; evidence: frame 9414 / TCP stream 99.\n\nMetrics: `{\"body_sha256\":\"30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844\",\"claimed_identities\":[{\"source\":\"explicit-body-label\",\"type\":\"hostname\",\"value\":\"Tampa-Office-PC\"},{\"source\":\"explicit-body-label\",\"type\":\"account\",\"value\":\"reginald.chandler\"}],\"destination\":\"170.238.117.187\",\"source\":\"10.8.20.101\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `reginald.chandler`; client IPs: 10.8.20.101; frames: 490, 498, 500, 512, 526\n- account: `tampa-office-pc$`; client IPs: 10.8.20.101; frames: 51, 59, 62, 77, 102\n- domain: `BADBUNDT`; client IPs: 10.8.20.101; frames: 8826, 10485, 11839, 11858, 12067\n- hostname: `TAMPA-OFFICE-PC`; client IPs: 10.8.20.101; frames: 1, 188, 256, 260, 369\n- netbios-group: `BADBUNDT`; client IPs: unbound subject; frames: 2, 255, 370, 376\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `112.146.166.173.b.barracudacentral.org`; roles: dns-query\n- domain: `112.146.166.173.cbl.abuseat.org`; roles: dns-query\n- domain: `112.146.166.173.dnsbl-1.uceprotect.net`; roles: dns-query\n- domain: `112.146.166.173.spam.dnsbl.sorbs.net`; roles: dns-query\n- domain: `112.146.166.173.zen.spamhaus.org`; roles: dns-query\n- domain: `222.222.67.208.in-addr.arpa`; roles: dns-query\n- domain: `activity.qingcloud.com`; roles: dns-query, http-host, tls-sni\n- domain: `api.ip.sb`; roles: dns-query, tls-sni\n- domain: `badbundt-dc.badbundt.com`; roles: dns-query\n- domain: `badbundt.com`; roles: dns-query\n- domain: `bh79sbu.com`; roles: dns-query, http-host\n- domain: `boozzdigital.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `gmail.com`; roles: dns-query, tls-sni\n- domain: `google.com`; roles: dns-query, http-host, tls-sni\n- domain: `hne53brianaea.com`; roles: dns-query, http-host\n- domain: `idogoiania.com.br`; roles: dns-query, http-host, tls-sni\n- domain: `isatap.badbundt.com`; roles: dns-query\n- domain: `isatap.localdomain`; roles: dns-query\n- domain: `kjoanaxbrennan.top`; roles: dns-query, tls-sni\n- domain: `mail.protonmail.com`; roles: dns-query, tls-sni\n- domain: `myip.opendns.com`; roles: dns-query\n- domain: `myip.opendns.com.badbundt.com`; roles: dns-query\n- domain: `resolver1.opendns.com`; roles: dns-query\n- domain: `tampa-office-pc.badbundt.com`; roles: dns-query\n- domain: `wpad.badbundt.com`; roles: dns-query\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `www.download.windowsupdate.com`; roles: dns-query, http-host\n- domain: `www.google.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.msftncsi.com`; roles: dns-query, http-host\n- ipv4: `10.8.20.1`; roles: network-endpoint\n- ipv4: `10.8.20.101`; roles: dns-answer, network-endpoint\n- ipv4: `10.8.20.255`; roles: network-endpoint\n- ipv4: `10.8.20.8`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `139.198.5.65`; roles: dns-answer, network-endpoint\n- ipv4: `170.238.117.187`; roles: http-host, network-endpoint\n- ipv4: `172.217.6.133`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.6.174`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.9.132`; roles: dns-answer, network-endpoint\n- ipv4: `173.166.146.112`; roles: dns-answer\n- ipv4: `185.117.75.41`; roles: network-endpoint\n- ipv4: `185.183.98.232`; roles: http-host, network-endpoint\n- ipv4: `185.193.141.166`; roles: dns-answer, network-endpoint\n- ipv4: `185.248.87.88`; roles: dns-answer, network-endpoint\n- ipv4: `185.70.40.151`; roles: dns-answer, network-endpoint\n- ipv4: `191.37.181.152`; roles: network-endpoint\n- ipv4: `192.185.170.206`; roles: network-endpoint\n- ipv4: `192.252.210.19`; roles: network-endpoint\n- ipv4: `206.189.74.47`; roles: dns-answer, network-endpoint\n- ipv4: `208.67.222.222`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.200.143.27`; roles: dns-answer\n- ipv4: `23.200.143.35`; roles: dns-answer\n- ipv4: `23.200.143.41`; roles: dns-answer\n- ipv4: `23.200.143.43`; roles: dns-answer\n- ipv4: `23.200.143.50`; roles: dns-answer\n- ipv4: `23.200.143.56`; roles: dns-answer\n- ipv4: `23.200.143.57`; roles: dns-answer\n- ipv4: `23.200.143.72`; roles: dns-answer, network-endpoint\n- ipv4: `23.200.143.74`; roles: dns-answer\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `5.39.113.142`; roles: network-endpoint\n- ipv4: `63.239.233.68`; roles: dns-answer\n- ipv4: `63.239.233.75`; roles: dns-answer\n- ipv4: `63.239.233.76`; roles: dns-answer\n- ipv4: `63.239.233.82`; roles: dns-answer\n- ipv4: `63.239.233.83`; roles: dns-answer\n- ipv4: `63.239.233.84`; roles: dns-answer\n- ipv4: `63.239.233.90`; roles: dns-answer, network-endpoint\n- ipv4: `63.239.233.91`; roles: dns-answer\n- ipv4: `63.239.233.92`; roles: dns-answer\n- ipv4: `68.183.185.221`; roles: dns-answer, network-endpoint\n- ipv4: `89.105.203.184`; roles: network-endpoint\n- ipv4: `94.103.86.146`; roles: dns-answer, network-endpoint\n- ipv4: `94.103.87.160`; roles: dns-answer, network-endpoint\n- ja3: `1d095e68489d3c535297cd8dffb06cb9`; roles: tls-client-fingerprint\n- ja3: `398430069e0a8ecfbc8db0778d658d77`; roles: tls-client-fingerprint\n- ja3: `4d7a28d6f2263ed61de88ca66eb011e3`; roles: tls-client-fingerprint\n- ja3: `6734f37431670b3ab4292b8f60f29984`; roles: tls-client-fingerprint\n- sha256: `218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30`; roles: exported-object\n- sha256: `30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844`; roles: exported-object\n- sha256: `351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15`; roles: exported-object\n- sha256: `4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc`; roles: exported-object\n- sha256: `5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953`; roles: exported-object\n- sha256: `5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7`; roles: exported-object\n- sha256: `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; roles: exported-object\n- sha256: `7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a`; roles: exported-object\n- sha256: `9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345`; roles: exported-object\n- sha256: `9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc`; roles: exported-object\n- sha256: `b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23`; roles: exported-object\n- sha256: `c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582`; roles: exported-object\n- sha256: `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; roles: exported-object\n- sha256: `dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139`; roles: exported-object\n- sha256: `ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb`; roles: exported-object\n- sha256: `df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742`; roles: exported-object\n- sha256: `e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224`; roles: exported-object\n- sha256: `e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1`; roles: exported-object\n- sha256: `e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a`; roles: exported-object\n- sha256: `edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437`; roles: exported-object\n- sha256: `f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93`; roles: exported-object\n- url: `http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/`; roles: http-request\n- url: `http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/`; roles: http-request\n- url: `http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90`; roles: http-request\n- url: `http://185.183.98.232/samerton.png`; roles: http-request\n- url: `http://185.183.98.232/tablone.png`; roles: http-request\n- url: `http://185.183.98.232/wredneg2.png`; roles: http-request\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://activity.qingcloud.com/wp-content/uploads/2019/08/4antifreeze.rar`; roles: http-request\n- url: `http://bh79sbu.com/qtra/ttqr.php?l=csuv3.j12`; roles: http-request\n- url: `http://boozzdigital.com/wp-content/uploads/2019/08/antifreeze.rar`; roles: http-request\n- url: `http://google.com/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi`; roles: http-request\n- url: `http://hne53brianaea.com/favicon.ico`; roles: http-request\n- url: `http://hne53brianaea.com/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi`; roles: http-request\n- url: `http://hne53brianaea.com/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi`; roles: http-request\n- url: `http://hne53brianaea.com/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi`; roles: http-request\n- url: `http://idogoiania.com.br/wp-content/uploads/2019/08/3antifreeze.rar`; roles: http-request\n- url: `http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab`; roles: http-request\n- url: `http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png`; roles: http-request\n- url: `http://www.google.com/images/errors/robot.png`; roles: http-request\n- url: `http://www.msftncsi.com/ncsi.txt`; roles: http-request\n- user_agent: `Microsoft NCSI`; roles: http-client\n- user_agent: `Microsoft-CryptoAPI/6.1`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- user_agent: `test`; roles: http-client\n- user_agent: `WinHTTP loader/1.0`; roles: http-client\n- exported object `tablone.png`; SHA-256 `9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345`; size 845312 bytes\n SHA-1: `23dbcd2f06cd48296d8e8f5edffa0132e0900b2d`; MD5: `484c8b2d9c49ad07cf2f08587f515181`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7765,\"response_frame\":8566,\"server_ip\":\"185.183.98.232\",\"status_code\":\"200\",\"tcp_stream\":88,\"url\":\"http://185.183.98.232/tablone.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `samerton(1).png`; SHA-256 `c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582`; size 845312 bytes\n SHA-1: `9b6e9c84e918dad5e2799912a6f971be01eb6f25`; MD5: `7c96f51b36d5d2b747531713bc4c4b3d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6112,\"response_frame\":6851,\"server_ip\":\"185.183.98.232\",\"status_code\":\"200\",\"tcp_stream\":82,\"url\":\"http://185.183.98.232/samerton.png\"},{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":16701,\"response_frame\":17479,\"server_ip\":\"185.183.98.232\",\"status_code\":\"200\",\"tcp_stream\":141,\"url\":\"http://185.183.98.232/samerton.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `wredneg2.png`; SHA-256 `e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224`; size 842240 bytes\n SHA-1: `a03e6446e4d9e98eebca4f6a9b1487457543d584`; MD5: `2356b5471a1c4825b459193c7189d356`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10374,\"response_frame\":11294,\"server_ip\":\"185.183.98.232\",\"status_code\":\"200\",\"tcp_stream\":123,\"url\":\"http://185.183.98.232/wredneg2.png\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `ttqr.php%3fl=csuv3.j12`; SHA-256 `4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc`; size 551936 bytes\n SHA-1: `db910469f6cd5a6b1d08f681b1559005929ae30d`; MD5: `af442fcdcf8d2967ec463d92a25f7ac8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":687,\"response_frame\":1230,\"server_ip\":\"94.103.87.160\",\"status_code\":\"200\",\"tcp_stream\":44,\"url\":\"http://bh79sbu.com/qtra/ttqr.php?l=csuv3.j12\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `antifreeze.rar`; SHA-256 `9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc`; size 753229 bytes\n SHA-1: `7cbcd3753830d6878c5851c2f1e05977afea7446`; MD5: `dcee3bf1c38e4de196c549d7bbfb63ce`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12669,\"response_frame\":13445,\"server_ip\":\"68.183.185.221\",\"status_code\":\"200\",\"tcp_stream\":130,\"url\":\"http://boozzdigital.com/wp-content/uploads/2019/08/antifreeze.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `lux.avi`; SHA-256 `edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437`; size 275200 bytes\n SHA-1: `bb2123d29a2394e2e4a5649dff43ad6f23a94d10`; MD5: `8a8116b168bb326251d080024bf01841`; completeness: unknown; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1688,\"response_frame\":1951,\"server_ip\":\"94.103.86.146\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://hne53brianaea.com/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `z.avi`; SHA-256 `e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1`; size 218540 bytes\n SHA-1: `858bc7efcf43d9bac7c05f80bf49e31e7c05d081`; MD5: `6c23e6a08e21ba228a7c0aad0d19e985`; completeness: unknown; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1452,\"response_frame\":1678,\"server_ip\":\"94.103.86.146\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://hne53brianaea.com/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":218540,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `authrootstl.cab`; SHA-256 `7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a`; size 58000 bytes\n SHA-1: `5dcce1d09a846eea3d78ebea95fd8da9dcc8b61c`; MD5: `58a3badc25e15583224e2b922f370a4f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":2029,\"response_frame\":2082,\"server_ip\":\"23.200.143.72\",\"status_code\":\"200\",\"tcp_stream\":62,\"url\":\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":58000,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `robot.png`; SHA-256 `5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7`; size 6327 bytes\n SHA-1: `c32bb847daf52117ab93b723d7c57d8b1e75d36b`; MD5: `4c9acf280b47cef7def3fc91a34c7ffe`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1347,\"response_frame\":1354,\"server_ip\":\"172.217.9.132\",\"status_code\":\"200\",\"tcp_stream\":52,\"url\":\"http://www.google.com/images/errors/robot.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":6327,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `favicon.ico`; SHA-256 `e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a`; size 5430 bytes\n SHA-1: `0bcbe73d6a198f6e5ebafa035b734a12809cefa6`; MD5: `f74755b4757448d71fdcb4650a701816`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1680,\"response_frame\":1685,\"server_ip\":\"94.103.86.146\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://hne53brianaea.com/favicon.ico\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":5430,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `90`; SHA-256 `30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844`; size 4575 bytes\n SHA-1: `bc1063379e95064c7bdc092e00dee2d00fc01517`; MD5: `0a444aba2d48f39c2b2da1ca28d76410`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `googlelogo_color_150x54dp.png`; SHA-256 `dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139`; size 3170 bytes\n SHA-1: `d0cbc46850d8ed54625a3b2b01a2c31f37977e75`; MD5: `9d73b3aa30bce9d8f166de5178ae4338`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1345,\"response_frame\":1358,\"server_ip\":\"172.217.9.132\",\"status_code\":\"200\",\"tcp_stream\":51,\"url\":\"http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3170,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `L.avi`; SHA-256 `f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93`; size 2372 bytes\n SHA-1: `d706d4b64a8c08652b122915b8f0e5fec83e4b94`; MD5: `00587851b1c3a74af7b8a15173092d8d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1954,\"response_frame\":1957,\"server_ip\":\"94.103.86.146\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://hne53brianaea.com/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2372,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `90(2)`; SHA-256 `5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953`; size 2098 bytes\n SHA-1: `53f814e226c360b1e7c279a39c54297c45c59533`; MD5: `650747e56a2c645c7ba1d553512bd389`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `5.avi`; SHA-256 `b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23`; size 1743 bytes\n SHA-1: `6576521c61536e9c1dec5e5466e9faa748c9f802`; MD5: `a9e73a5589905bb3f79e05ef86bfcef0`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1331,\"response_frame\":1334,\"server_ip\":\"172.217.6.174\",\"status_code\":\"404\",\"tcp_stream\":50,\"url\":\"http://google.com/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1743,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `83`; SHA-256 `218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30`; size 320 bytes\n SHA-1: `618c39c8efeeb88dc3ca564921104c89e1b79462`; MD5: `192d38157667d5c0348c7194f9175830`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `3antifreeze.rar`; SHA-256 `ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb`; size 276 bytes\n SHA-1: `f306e7c172eac47139c960ddc55a5564754fea03`; MD5: `5797865257cd14f09d01b9ad1eb01a1c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3251,\"response_frame\":3253,\"server_ip\":\"206.189.74.47\",\"status_code\":\"301\",\"tcp_stream\":72,\"url\":\"http://idogoiania.com.br/wp-content/uploads/2019/08/3antifreeze.rar\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":276,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81`; SHA-256 `df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742`; size 271 bytes\n SHA-1: `14b964a11978e33d3f955e348039e2abb341f873`; MD5: `5ff02e22ab7c05ab17f92097896c6cf5`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `81(2)`; SHA-256 `351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15`; size 259 bytes\n SHA-1: `ca63c09f2648f07469a4fe97d635fa9a01cfba4b`; MD5: `a9680e363adbc052ce81e9918410016f`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ncsi.txt`; SHA-256 `6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012`; size 14 bytes\n SHA-1: `33bf88d5b82df3723d5863c7d23445e345828904`; MD5: `cd5a4d3fdd5bffc16bf959ef75cf37bc`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":413,\"response_frame\":415,\"server_ip\":\"63.239.233.90\",\"status_code\":\"200\",\"tcp_stream\":27,\"url\":\"http://www.msftncsi.com/ncsi.txt\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":14,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `81(1)`; SHA-256 `c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1`; size 3 bytes\n SHA-1: `ff0288c119791fc13a51965eb3a0e61be2c06338`; MD5: `fa06d89c65fb808240e37f4c9e128955`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6923,\"response_frame\":6927,\"server_ip\":\"170.238.117.187\",\"status_code\":\"200\",\"tcp_stream\":85,\"url\":\"http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/\"},{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7165,\"response_frame\":7743,\"server_ip\":\"170.238.117.187\",\"status_code\":\"200\",\"tcp_stream\":86,\"url\":\"http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/\"},{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7772,\"response_frame\":7860,\"server_ip\":\"170.238.117.187\",\"status_code\":\"200\",\"tcp_stream\":87,\"url\":\"http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/\"},{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9414,\"response_frame\":9420,\"server_ip\":\"170.238.117.187\",\"status_code\":\"200\",\"tcp_stream\":99,\"url\":\"http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90\"},{\"client_ip\":\"10.8.20.101\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18243,\"response_frame\":18249,\"server_ip\":\"170.238.117.187\",\"status_code\":\"200\",\"tcp_stream\":152,\"url\":\"http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `134aeb77b8ba938e55dc6221e696fd251149ddd40cfc18c78a3806d709fc25e3`; recorded 2026-09-22T16:04:12.245027+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":129,\"observable_limit\":5000,\"observables_checked\":129,\"observables_total\":129,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `76f521c2-4e4a-41d5-95ad-a44fd9887dd8` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `fa0da8be-03fb-404d-a526-6c99c6b4f000` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `05851801-c224-489b-b9da-9e5d035c60b4` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 4 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 5 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 6 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":21,\"export_status\":\"completed\",\"exported_objects\":26,\"hashed_bytes\":5261951,\"hashed_objects\":26,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":21,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":21}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 8/8, identities 5/5, observables 129/129, artifacts 21/21. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n118 typed observations; 5 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `6a1182c395abfda3583ee13c9ffa47a957f53d7293dc6062b516f5b47557d30e`.\n\n- ipv4 `170.238.117.187` — suspicious; evidence: `[{\"finding_id\":\"finding-09183bb881ce24b3835e0d8f\",\"frame_number\":7772,\"kind\":\"behavior\",\"rule_id\":\"sensitive-data-in-cleartext\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:25.460595+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:25.276882+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:25.274231+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345` — suspicious; evidence: `[{\"artifact_id\":\"artifact-cb85ff6cff4451bcfbb76fd3\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[8566],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:26.277919+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:26.040610+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:26.036610+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582` — suspicious; evidence: `[{\"artifact_id\":\"artifact-a709cdf7664add74a5670a6c\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[6851,17479],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:26.823819+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:26.643576+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:26.638749+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- sha256 `e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224` — suspicious; evidence: `[{\"artifact_id\":\"artifact-c57ae597edfeec3101feee66\",\"features\":[\"pe-bytes-under-non-executable-url-extension\"],\"frames\":[11294],\"interpretation\":\"A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict.\",\"kind\":\"static-review\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:27.367399+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:27.177782+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:46:27.176033+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- url `http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/` — suspicious; evidence: `[{\"finding_id\":\"finding-09183bb881ce24b3835e0d8f\",\"frame_number\":7772,\"kind\":\"behavior\",\"rule_id\":\"sensitive-data-in-cleartext\"}]`; provider signals: `[]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `86b346b0a7d28bcf26a3b2351bb2f91788ec860bab5f099312ac89cb5a8492f6`; updated 2026-09-22T17:46:34.477594+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-7adb3bbfc0a683bf830d1b38\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-7adb3bbfc0a683bf830d1b38\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-048cdd6f0b38901637449708\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-048cdd6f0b38901637449708\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-1f1600b025b974237d45a23a\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-1f1600b025b974237d45a23a\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-293052200eda7e4390f50794\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-293052200eda7e4390f50794\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-d81c14f34c0a837fca3e70c5\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-d81c14f34c0a837fca3e70c5\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-e15727ee89ede04ed5437319\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-e15727ee89ede04ed5437319\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-c66c4ebcd441dcaf2aea57d4\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-c66c4ebcd441dcaf2aea57d4\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-383ce369310daf86ee18e3a5\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-383ce369310daf86ee18e3a5\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-76112c7ac88b5df439bc95c0\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-76112c7ac88b5df439bc95c0\",\"provider\":\"threatfox\",\"status\":\"not_found\"},{\"observable_id\":\"observable-228211530e98896a451e3445\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-228211530e98896a451e3445\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":10,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":10,\"retained_targets\":40,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 7208, "stream": 0, "flow_id": "flow-380d74e0812335283d633d8a", "packets": 76, "transport": "udp", "last_frame": 18246, "first_frame": 1, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 7208, "last_seen_epoch": "1566331166.351293", "responder_bytes": 0, "first_seen_epoch": "1566329449.865545" }, { "bytes": 308, "stream": 1, "flow_id": "flow-141c05c9576f0ebf3be29d04", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 57565, "responder_port": 53, "initiator_bytes": 124, "last_seen_epoch": "1566329449.877379", "responder_bytes": 184, "first_seen_epoch": "1566329449.877162" }, { "bytes": 308, "stream": 2, "flow_id": "flow-50174cae36845e2592ee9826", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 61835, "responder_port": 53, "initiator_bytes": 124, "last_seen_epoch": "1566329449.878593", "responder_bytes": 184, "first_seen_epoch": "1566329449.878429" }, { "bytes": 184, "stream": 3, "flow_id": "flow-ca85e76eec5b83c1d18dacf3", "packets": 2, "transport": "udp", "last_frame": 9, "first_frame": 7, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 50268, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1566329449.881124", "responder_bytes": 100, "first_seen_epoch": "1566329449.880862" }, { "bytes": 184, "stream": 4, "flow_id": "flow-92d7312ddea3332297753527", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 8, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 55549, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1566329449.881216", "responder_bytes": 100, "first_seen_epoch": "1566329449.881049" }, { "bytes": 436, "stream": 5, "flow_id": "flow-9531625f04808fbeadae865c", "packets": 2, "transport": "udp", "last_frame": 12, "first_frame": 11, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 55551, "responder_port": 389, "initiator_bytes": 212, "last_seen_epoch": "1566329449.883991", "responder_bytes": 224, "first_seen_epoch": "1566329449.883677" }, { "bytes": 479, "stream": 6, "flow_id": "flow-555269ee296f4aafcd2d503e", "packets": 2, "transport": "udp", "last_frame": 14, "first_frame": 13, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 55552, "responder_port": 389, "initiator_bytes": 255, "last_seen_epoch": "1566329449.884531", "responder_bytes": 224, "first_seen_epoch": "1566329449.884234" }, { "bytes": 150, "stream": 7, "flow_id": "flow-4922fdd09de643e961c43f20", "packets": 2, "transport": "udp", "last_frame": 25, "first_frame": 17, "initiator_ip": "10.8.20.101", "responder_ip": "224.0.0.252", "initiator_port": 54555, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1566329450.020836", "responder_bytes": 0, "first_seen_epoch": "1566329449.920576" }, { "bytes": 2380, "stream": 0, "flow_id": "flow-b50c0e5733f077725dc87603", "packets": 18, "transport": "tcp", "last_frame": 678, "first_frame": 18, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49155, "responder_port": 135, "initiator_bytes": 1270, "last_seen_epoch": "1566329479.056979", "responder_bytes": 1110, "first_seen_epoch": "1566329450.011636" }, { "bytes": 4428, "stream": 1, "flow_id": "flow-384ec602e6124b5ddeb3f6f5", "packets": 20, "transport": "tcp", "last_frame": 676, "first_frame": 26, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49156, "responder_port": 49158, "initiator_bytes": 2562, "last_seen_epoch": "1566329479.056833", "responder_bytes": 1866, "first_seen_epoch": "1566329450.020923" }, { "bytes": 8955, "stream": 2, "flow_id": "flow-4d9817a0f222096d79c34477", "packets": 29, "transport": "tcp", "last_frame": 220, "first_frame": 41, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49157, "responder_port": 389, "initiator_bytes": 4352, "last_seen_epoch": "1566329450.292071", "responder_bytes": 4603, "first_seen_epoch": "1566329450.031636" }, { "bytes": 973, "stream": 3, "flow_id": "flow-7a8b20f23206e4382078f4ac", "packets": 8, "transport": "tcp", "last_frame": 55, "first_frame": 48, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49158, "responder_port": 88, "initiator_bytes": 468, "last_seen_epoch": "1566329450.049008", "responder_bytes": 505, "first_seen_epoch": "1566329450.046166" }, { "bytes": 2471, "stream": 4, "flow_id": "flow-c188d42da5d0de015fedede4", "packets": 10, "transport": "tcp", "last_frame": 67, "first_frame": 56, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49159, "responder_port": 88, "initiator_bytes": 602, "last_seen_epoch": "1566329450.070385", "responder_bytes": 1869, "first_seen_epoch": "1566329450.066643" }, { "bytes": 288, "stream": 8, "flow_id": "flow-c86b1b90709c3c610d966b5a", "packets": 2, "transport": "udp", "last_frame": 63, "first_frame": 60, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 64793, "responder_port": 53, "initiator_bytes": 114, "last_seen_epoch": "1566329450.068849", "responder_bytes": 174, "first_seen_epoch": "1566329450.068573" }, { "bytes": 3865, "stream": 5, "flow_id": "flow-64e470d4d4dcbfdf6865e270", "packets": 12, "transport": "tcp", "last_frame": 81, "first_frame": 68, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49160, "responder_port": 88, "initiator_bytes": 1945, "last_seen_epoch": "1566329450.07487", "responder_bytes": 1920, "first_seen_epoch": "1566329450.071598" }, { "bytes": 436, "stream": 9, "flow_id": "flow-d3b4897c2cb00806111839ed", "packets": 2, "transport": "udp", "last_frame": 71, "first_frame": 70, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 64794, "responder_port": 389, "initiator_bytes": 212, "last_seen_epoch": "1566329450.072336", "responder_bytes": 224, "first_seen_epoch": "1566329450.072046" }, { "bytes": 6763, "stream": 6, "flow_id": "flow-8e1a273748e4cf0ed634f8eb", "packets": 25, "transport": "tcp", "last_frame": 661, "first_frame": 82, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49161, "responder_port": 445, "initiator_bytes": 4803, "last_seen_epoch": "1566329466.562438", "responder_bytes": 1960, "first_seen_epoch": "1566329450.074961" }, { "bytes": 973, "stream": 7, "flow_id": "flow-d0775e93fcc7c1ecdf0ed412", "packets": 8, "transport": "tcp", "last_frame": 106, "first_frame": 97, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49162, "responder_port": 88, "initiator_bytes": 468, "last_seen_epoch": "1566329450.080035", "responder_bytes": 505, "first_seen_epoch": "1566329450.078752" }, { "bytes": 318, "stream": 10, "flow_id": "flow-8619cc30186816235aaf9912", "packets": 2, "transport": "udp", "last_frame": 101, "first_frame": 99, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 50892, "responder_port": 53, "initiator_bytes": 129, "last_seen_epoch": "1566329450.079103", "responder_bytes": 189, "first_seen_epoch": "1566329450.078946" }, { "bytes": 420, "stream": 11, "flow_id": "flow-e0d205943ed671869776012d", "packets": 2, "transport": "udp", "last_frame": 108, "first_frame": 107, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 50893, "responder_port": 389, "initiator_bytes": 190, "last_seen_epoch": "1566329450.081246", "responder_bytes": 230, "first_seen_epoch": "1566329450.081063" }, { "bytes": 2471, "stream": 8, "flow_id": "flow-bd2acabcc1f86b5f75752a8f", "packets": 10, "transport": "tcp", "last_frame": 119, "first_frame": 110, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49163, "responder_port": 88, "initiator_bytes": 602, "last_seen_epoch": "1566329450.103111", "responder_bytes": 1869, "first_seen_epoch": "1566329450.100312" }, { "bytes": 3865, "stream": 9, "flow_id": "flow-455fb138e4dfd2e5d2d2097d", "packets": 12, "transport": "tcp", "last_frame": 131, "first_frame": 120, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49164, "responder_port": 88, "initiator_bytes": 1945, "last_seen_epoch": "1566329450.106439", "responder_bytes": 1920, "first_seen_epoch": "1566329450.103539" }, { "bytes": 3359, "stream": 10, "flow_id": "flow-c659e6f8523694d064e58db4", "packets": 8, "transport": "tcp", "last_frame": 139, "first_frame": 132, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49165, "responder_port": 88, "initiator_bytes": 1673, "last_seen_epoch": "1566329450.107954", "responder_bytes": 1686, "first_seen_epoch": "1566329450.106534" }, { "bytes": 5473, "stream": 11, "flow_id": "flow-7e7c99514c036602654c8c3c", "packets": 15, "transport": "tcp", "last_frame": 185, "first_frame": 149, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49166, "responder_port": 389, "initiator_bytes": 2577, "last_seen_epoch": "1566329450.18499", "responder_bytes": 2896, "first_seen_epoch": "1566329450.172231" }, { "bytes": 3887, "stream": 12, "flow_id": "flow-02c83da12b6d0e1192129cc4", "packets": 12, "transport": "tcp", "last_frame": 167, "first_frame": 156, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49167, "responder_port": 88, "initiator_bytes": 1959, "last_seen_epoch": "1566329450.182105", "responder_bytes": 1928, "first_seen_epoch": "1566329450.179977" }, { "bytes": 348, "stream": 13, "flow_id": "flow-3ade4165b76d10428900f81d", "packets": 6, "transport": "tcp", "last_frame": 178, "first_frame": 168, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49168, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1566329450.183689", "responder_bytes": 174, "first_seen_epoch": "1566329450.182208" }, { "bytes": 318, "stream": 12, "flow_id": "flow-3b8cd2f82c757a8dc3fd90c6", "packets": 2, "transport": "udp", "last_frame": 181, "first_frame": 180, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 64669, "responder_port": 53, "initiator_bytes": 129, "last_seen_epoch": "1566329450.184657", "responder_bytes": 189, "first_seen_epoch": "1566329450.184474" }, { "bytes": 420, "stream": 13, "flow_id": "flow-e539eaf8f7b15f8fe7344f0c", "packets": 2, "transport": "udp", "last_frame": 187, "first_frame": 186, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 64670, "responder_port": 389, "initiator_bytes": 190, "last_seen_epoch": "1566329450.187969", "responder_bytes": 230, "first_seen_epoch": "1566329450.187642" }, { "bytes": 348, "stream": 14, "flow_id": "flow-ea5a8598d003103f7d891b33", "packets": 6, "transport": "tcp", "last_frame": 197, "first_frame": 191, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49170, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1566329450.285253", "responder_bytes": 174, "first_seen_epoch": "1566329450.28411" }, { "bytes": 348, "stream": 15, "flow_id": "flow-0942a0a63455caee319ef0df", "packets": 6, "transport": "tcp", "last_frame": 205, "first_frame": 199, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49171, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1566329450.288392", "responder_bytes": 174, "first_seen_epoch": "1566329450.28708" }, { "bytes": 348, "stream": 16, "flow_id": "flow-c51c0bd4a56a351a22df34ae", "packets": 6, "transport": "tcp", "last_frame": 213, "first_frame": 207, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49172, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1566329450.290416", "responder_bytes": 174, "first_seen_epoch": "1566329450.289511" }, { "bytes": 10776, "stream": 17, "flow_id": "flow-218c08fe71183e7a6d1dc19d", "packets": 37, "transport": "tcp", "last_frame": 1255, "first_frame": 226, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49173, "responder_port": 49155, "initiator_bytes": 6992, "last_seen_epoch": "1566329509.054894", "responder_bytes": 3784, "first_seen_epoch": "1566329450.53827" }, { "bytes": 3887, "stream": 18, "flow_id": "flow-fa70d89ef6b53a76e9aa9bb7", "packets": 12, "transport": "tcp", "last_frame": 240, "first_frame": 229, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49174, "responder_port": 88, "initiator_bytes": 1959, "last_seen_epoch": "1566329450.542975", "responder_bytes": 1928, "first_seen_epoch": "1566329450.539097" }, { "bytes": 323, "stream": 14, "flow_id": "flow-bb930fbe8099f693ea064e33", "packets": 2, "transport": "udp", "last_frame": 262, "first_frame": 261, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 59257, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1566329451.120527", "responder_bytes": 197, "first_seen_epoch": "1566329451.120117" }, { "bytes": 261, "stream": 15, "flow_id": "flow-0dbf0380aff9ac67fb4e281d", "packets": 2, "transport": "udp", "last_frame": 264, "first_frame": 263, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 58125, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1566329451.121263", "responder_bytes": 166, "first_seen_epoch": "1566329451.12108" }, { "bytes": 8056, "stream": 19, "flow_id": "flow-cddb196948939f2917a203c3", "packets": 20, "transport": "tcp", "last_frame": 374, "first_frame": 265, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49175, "responder_port": 389, "initiator_bytes": 3362, "last_seen_epoch": "1566329451.536746", "responder_bytes": 4694, "first_seen_epoch": "1566329451.122832" }, { "bytes": 3823, "stream": 20, "flow_id": "flow-9f233d9c31f8f3b6b112bb92", "packets": 12, "transport": "tcp", "last_frame": 287, "first_frame": 276, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49176, "responder_port": 88, "initiator_bytes": 1931, "last_seen_epoch": "1566329451.13384", "responder_bytes": 1892, "first_seen_epoch": "1566329451.132008" }, { "bytes": 3491, "stream": 21, "flow_id": "flow-add4e78323ce1d452971c745", "packets": 10, "transport": "tcp", "last_frame": 299, "first_frame": 288, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49177, "responder_port": 88, "initiator_bytes": 1733, "last_seen_epoch": "1566329451.138264", "responder_bytes": 1758, "first_seen_epoch": "1566329451.136018" }, { "bytes": 3265, "stream": 22, "flow_id": "flow-fbf671e91bd30fa555f93d14", "packets": 10, "transport": "tcp", "last_frame": 312, "first_frame": 300, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49178, "responder_port": 88, "initiator_bytes": 2845, "last_seen_epoch": "1566329451.13977", "responder_bytes": 420, "first_seen_epoch": "1566329451.138442" }, { "bytes": 3347, "stream": 23, "flow_id": "flow-207d863ea2722d761fce7d74", "packets": 13, "transport": "tcp", "last_frame": 366, "first_frame": 303, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49179, "responder_port": 389, "initiator_bytes": 2499, "last_seen_epoch": "1566329451.153752", "responder_bytes": 848, "first_seen_epoch": "1566329451.138812" }, { "bytes": 8527, "stream": 24, "flow_id": "flow-756cc73473a18158b5b46dc7", "packets": 33, "transport": "tcp", "last_frame": 667, "first_frame": 323, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49180, "responder_port": 445, "initiator_bytes": 5751, "last_seen_epoch": "1566329466.563999", "responder_bytes": 2776, "first_seen_epoch": "1566329451.144443" }, { "bytes": 3865, "stream": 25, "flow_id": "flow-8a6e7bf4fa9db132540a60e5", "packets": 12, "transport": "tcp", "last_frame": 340, "first_frame": 328, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49181, "responder_port": 88, "initiator_bytes": 1945, "last_seen_epoch": "1566329451.147703", "responder_bytes": 1920, "first_seen_epoch": "1566329451.145994" }, { "bytes": 3359, "stream": 26, "flow_id": "flow-b89bbe6e8e70074f02c3446c", "packets": 8, "transport": "tcp", "last_frame": 347, "first_frame": 339, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49182, "responder_port": 88, "initiator_bytes": 1673, "last_seen_epoch": "1566329451.14892", "responder_bytes": 1686, "first_seen_epoch": "1566329451.147693" }, { "bytes": 150, "stream": 16, "flow_id": "flow-e51299d200abb73b5165ce0b", "packets": 2, "transport": "udp", "last_frame": 385, "first_frame": 381, "initiator_ip": "10.8.20.101", "responder_ip": "224.0.0.252", "initiator_port": 61629, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1566329453.19657", "responder_bytes": 0, "first_seen_epoch": "1566329453.099275" }, { "bytes": 225, "stream": 17, "flow_id": "flow-513cdfa876d51b1e6758e52f", "packets": 2, "transport": "udp", "last_frame": 383, "first_frame": 382, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 52212, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1566329453.107285", "responder_bytes": 148, "first_seen_epoch": "1566329453.107072" }, { "bytes": 128, "stream": 18, "flow_id": "flow-b521be6dc5d37c9ec796bf32", "packets": 2, "transport": "udp", "last_frame": 386, "first_frame": 384, "initiator_ip": "10.8.20.101", "responder_ip": "224.0.0.252", "initiator_port": 50071, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1566329453.207511", "responder_bytes": 0, "first_seen_epoch": "1566329453.107937" }, { "bytes": 184, "stream": 19, "flow_id": "flow-eabad952376897138722e6e3", "packets": 2, "transport": "udp", "last_frame": 390, "first_frame": 389, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 63819, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1566329453.215159", "responder_bytes": 100, "first_seen_epoch": "1566329453.214843" }, { "bytes": 229, "stream": 20, "flow_id": "flow-f68f5f4cf24f864c94a25a4b", "packets": 2, "transport": "udp", "last_frame": 392, "first_frame": 391, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 54972, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1566329453.229263", "responder_bytes": 150, "first_seen_epoch": "1566329453.229001" }, { "bytes": 231, "stream": 21, "flow_id": "flow-a51177844a09e8cf0f82cfbd", "packets": 2, "transport": "udp", "last_frame": 394, "first_frame": 393, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 61765, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1566329453.374403", "responder_bytes": 153, "first_seen_epoch": "1566329453.374157" }, { "bytes": 150, "stream": 22, "flow_id": "flow-74c7dee4ff0e4658838ce750", "packets": 2, "transport": "udp", "last_frame": 400, "first_frame": 397, "initiator_ip": "10.8.20.101", "responder_ip": "224.0.0.252", "initiator_port": 58165, "responder_port": 5355, "initiator_bytes": 150, "last_seen_epoch": "1566329453.496826", "responder_bytes": 0, "first_seen_epoch": "1566329453.397402" }, { "bytes": 184, "stream": 23, "flow_id": "flow-5002c02eb2186fb81be90ccc", "packets": 2, "transport": "udp", "last_frame": 404, "first_frame": 403, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 54358, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1566329454.714016", "responder_bytes": 100, "first_seen_epoch": "1566329454.713695" }, { "bytes": 660, "stream": 24, "flow_id": "flow-160876177d926a0a6164c8b7", "packets": 6, "transport": "udp", "last_frame": 18385, "first_frame": 405, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 330, "last_seen_epoch": "1566331502.756392", "responder_bytes": 330, "first_seen_epoch": "1566329454.714691" }, { "bytes": 370, "stream": 25, "flow_id": "flow-58fa2dc1d152ab07bf5e796f", "packets": 2, "transport": "udp", "last_frame": 409, "first_frame": 408, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 54351, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1566329455.710994", "responder_bytes": 294, "first_seen_epoch": "1566329455.680831" }, { "bytes": 778, "stream": 27, "flow_id": "flow-cabd4b65a6c4a54a380e76be", "packets": 9, "transport": "tcp", "last_frame": 418, "first_frame": 410, "initiator_ip": "10.8.20.101", "responder_ip": "63.239.233.90", "initiator_port": 49183, "responder_port": 80, "initiator_bytes": 379, "last_seen_epoch": "1566329455.768866", "responder_bytes": 399, "first_seen_epoch": "1566329455.715947" }, { "bytes": 251, "stream": 26, "flow_id": "flow-8812bff71194f1b1afaef496", "packets": 2, "transport": "udp", "last_frame": 420, "first_frame": 419, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 57797, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1566329458.111494", "responder_bytes": 163, "first_seen_epoch": "1566329458.111159" }, { "bytes": 304, "stream": 27, "flow_id": "flow-f0295b3e236f0baf1df1392e", "packets": 2, "transport": "udp", "last_frame": 422, "first_frame": 421, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 64095, "responder_port": 53, "initiator_bytes": 152, "last_seen_epoch": "1566329458.112974", "responder_bytes": 152, "first_seen_epoch": "1566329458.112209" }, { "bytes": 7092, "stream": 28, "flow_id": "flow-001af0223fb0f416290afe2f", "packets": 21, "transport": "tcp", "last_frame": 486, "first_frame": 423, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49185, "responder_port": 389, "initiator_bytes": 3371, "last_seen_epoch": "1566329460.862477", "responder_bytes": 3721, "first_seen_epoch": "1566329460.821487" }, { "bytes": 4132, "stream": 29, "flow_id": "flow-12cdd56c18e069e35830005b", "packets": 13, "transport": "tcp", "last_frame": 484, "first_frame": 442, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49186, "responder_port": 389, "initiator_bytes": 3324, "last_seen_epoch": "1566329460.86194", "responder_bytes": 808, "first_seen_epoch": "1566329460.832605" }, { "bytes": 973, "stream": 30, "flow_id": "flow-12f46cb1db36388597a22d56", "packets": 8, "transport": "tcp", "last_frame": 458, "first_frame": 451, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49187, "responder_port": 88, "initiator_bytes": 468, "last_seen_epoch": "1566329460.839488", "responder_bytes": 505, "first_seen_epoch": "1566329460.837853" }, { "bytes": 2471, "stream": 31, "flow_id": "flow-597c7b1eafe5d737bf4dfce8", "packets": 10, "transport": "tcp", "last_frame": 468, "first_frame": 459, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49188, "responder_port": 88, "initiator_bytes": 602, "last_seen_epoch": "1566329460.856644", "responder_bytes": 1869, "first_seen_epoch": "1566329460.854992" }, { "bytes": 3761, "stream": 32, "flow_id": "flow-5ac50610fa112c85544ef367", "packets": 12, "transport": "tcp", "last_frame": 480, "first_frame": 469, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49189, "responder_port": 88, "initiator_bytes": 1897, "last_seen_epoch": "1566329460.858678", "responder_bytes": 1864, "first_seen_epoch": "1566329460.857154" }, { "bytes": 925, "stream": 33, "flow_id": "flow-74b7197a1f0ba1e8b6f42b18", "packets": 8, "transport": "tcp", "last_frame": 494, "first_frame": 487, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49190, "responder_port": 88, "initiator_bytes": 461, "last_seen_epoch": "1566329464.351852", "responder_bytes": 464, "first_seen_epoch": "1566329464.349508" }, { "bytes": 2491, "stream": 34, "flow_id": "flow-d59339482928bc01b558cf7d", "packets": 10, "transport": "tcp", "last_frame": 504, "first_frame": 495, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49191, "responder_port": 88, "initiator_bytes": 595, "last_seen_epoch": "1566329464.375099", "responder_bytes": 1896, "first_seen_epoch": "1566329464.372822" }, { "bytes": 3699, "stream": 35, "flow_id": "flow-36cd3264f7b93d8f7acb99c2", "packets": 12, "transport": "tcp", "last_frame": 516, "first_frame": 505, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49192, "responder_port": 88, "initiator_bytes": 1834, "last_seen_epoch": "1566329464.377299", "responder_bytes": 1865, "first_seen_epoch": "1566329464.375301" }, { "bytes": 3971, "stream": 36, "flow_id": "flow-5c367195f23d37ab876ee516", "packets": 12, "transport": "tcp", "last_frame": 530, "first_frame": 519, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49193, "responder_port": 88, "initiator_bytes": 2001, "last_seen_epoch": "1566329464.418226", "responder_bytes": 1970, "first_seen_epoch": "1566329464.415933" }, { "bytes": 40770, "stream": 37, "flow_id": "flow-6652fc8a8df08e977c82a824", "packets": 230, "transport": "tcp", "last_frame": 18426, "first_frame": 545, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49194, "responder_port": 445, "initiator_bytes": 22800, "last_seen_epoch": "1566331636.841896", "responder_bytes": 17970, "first_seen_epoch": "1566329464.451759" }, { "bytes": 3949, "stream": 38, "flow_id": "flow-89c19fdf526fb6a306adc9a2", "packets": 12, "transport": "tcp", "last_frame": 563, "first_frame": 552, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49195, "responder_port": 88, "initiator_bytes": 1987, "last_seen_epoch": "1566329464.458901", "responder_bytes": 1962, "first_seen_epoch": "1566329464.456818" }, { "bytes": 3659, "stream": 39, "flow_id": "flow-cedf847a49cc4dcbe358f8e1", "packets": 12, "transport": "tcp", "last_frame": 575, "first_frame": 564, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49196, "responder_port": 88, "initiator_bytes": 1823, "last_seen_epoch": "1566329464.460011", "responder_bytes": 1836, "first_seen_epoch": "1566329464.459044" }, { "bytes": 323, "stream": 28, "flow_id": "flow-54be6360e7eb40043df271b4", "packets": 2, "transport": "udp", "last_frame": 591, "first_frame": 590, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 55748, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1566329464.94353", "responder_bytes": 197, "first_seen_epoch": "1566329464.943297" }, { "bytes": 261, "stream": 29, "flow_id": "flow-0bde5f4373ad52bd089081ed", "packets": 2, "transport": "udp", "last_frame": 593, "first_frame": 592, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 52196, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1566329464.945543", "responder_bytes": 166, "first_seen_epoch": "1566329464.945404" }, { "bytes": 5246, "stream": 40, "flow_id": "flow-34da55ea915f3b164ac1014e", "packets": 16, "transport": "tcp", "last_frame": 654, "first_frame": 594, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49197, "responder_port": 389, "initiator_bytes": 2956, "last_seen_epoch": "1566329465.46491", "responder_bytes": 2290, "first_seen_epoch": "1566329464.946214" }, { "bytes": 3949, "stream": 41, "flow_id": "flow-05454bda131997a0d913f9aa", "packets": 12, "transport": "tcp", "last_frame": 608, "first_frame": 597, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49198, "responder_port": 88, "initiator_bytes": 1987, "last_seen_epoch": "1566329464.948685", "responder_bytes": 1962, "first_seen_epoch": "1566329464.94712" }, { "bytes": 3521, "stream": 42, "flow_id": "flow-94fe588285aba5c434727e9f", "packets": 15, "transport": "tcp", "last_frame": 647, "first_frame": 615, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49199, "responder_port": 389, "initiator_bytes": 2619, "last_seen_epoch": "1566329464.965734", "responder_bytes": 902, "first_seen_epoch": "1566329464.953706" }, { "bytes": 6948, "stream": 43, "flow_id": "flow-76b410a199cd114f48294411", "packets": 25, "transport": "tcp", "last_frame": 1251, "first_frame": 628, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49200, "responder_port": 445, "initiator_bytes": 5090, "last_seen_epoch": "1566329502.553988", "responder_bytes": 1858, "first_seen_epoch": "1566329464.960334" }, { "bytes": 168, "stream": 30, "flow_id": "flow-aff3e11808af86f930092e99", "packets": 2, "transport": "udp", "last_frame": 655, "first_frame": 650, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 51822, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1566329465.486337", "responder_bytes": 92, "first_seen_epoch": "1566329465.46003" }, { "bytes": 158, "stream": 31, "flow_id": "flow-e72f7c094fd225fc5f57bc8c", "packets": 2, "transport": "udp", "last_frame": 683, "first_frame": 682, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 51179, "responder_port": 53, "initiator_bytes": 71, "last_seen_epoch": "1566329493.560314", "responder_bytes": 87, "first_seen_epoch": "1566329493.32434" }, { "bytes": 582086, "stream": 44, "flow_id": "flow-ca8f8ed3e237dbcaa96aa2b8", "packets": 550, "transport": "tcp", "last_frame": 1233, "first_frame": 684, "initiator_ip": "10.8.20.101", "responder_ip": "94.103.87.160", "initiator_port": 49202, "responder_port": 80, "initiator_bytes": 9008, "last_seen_epoch": "1566329496.252813", "responder_bytes": 573078, "first_seen_epoch": "1566329493.58186" }, { "bytes": 604, "stream": 45, "flow_id": "flow-cc5f98b88f26bbae65f2a130", "packets": 11, "transport": "tcp", "last_frame": 1285, "first_frame": 1259, "initiator_ip": "10.8.20.8", "responder_ip": "10.8.20.101", "initiator_port": 445, "responder_port": 49201, "initiator_bytes": 604, "last_seen_epoch": "1566329562.81786", "responder_bytes": 0, "first_seen_epoch": "1566329542.709683" }, { "bytes": 1280, "stream": 46, "flow_id": "flow-75345df6099f515b127f49c6", "packets": 12, "transport": "tcp", "last_frame": 1296, "first_frame": 1268, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49203, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1566329570.649257", "responder_bytes": 562, "first_seen_epoch": "1566329560.63664" }, { "bytes": 1464, "stream": 47, "flow_id": "flow-f6c27e2c6b48c9df727d6dfb", "packets": 12, "transport": "tcp", "last_frame": 1294, "first_frame": 1275, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49204, "responder_port": 49155, "initiator_bytes": 870, "last_seen_epoch": "1566329570.649161", "responder_bytes": 594, "first_seen_epoch": "1566329560.638108" }, { "bytes": 1050, "stream": 32, "flow_id": "flow-35cdf5a34c300d7b728a4514", "packets": 6, "transport": "udp", "last_frame": 1302, "first_frame": 1287, "initiator_ip": "10.8.20.101", "responder_ip": "239.255.255.250", "initiator_port": 51181, "responder_port": 1900, "initiator_bytes": 1050, "last_seen_epoch": "1566329576.873927", "responder_bytes": 0, "first_seen_epoch": "1566329570.525266" }, { "bytes": 184, "stream": 48, "flow_id": "flow-10ca0c24bcb632adc4c2a745", "packets": 2, "transport": "tcp", "last_frame": 2117, "first_frame": 1298, "initiator_ip": "192.185.170.206", "responder_ip": "10.8.20.101", "initiator_port": 26, "responder_port": 49208, "initiator_bytes": 184, "last_seen_epoch": "1566330083.6636", "responder_bytes": 0, "first_seen_epoch": "1566329572.334535" }, { "bytes": 225, "stream": 33, "flow_id": "flow-5e50894565f70f1eb5fb7315", "packets": 2, "transport": "udp", "last_frame": 1318, "first_frame": 1317, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 62399, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1566329681.344602", "responder_bytes": 148, "first_seen_epoch": "1566329681.344278" }, { "bytes": 227, "stream": 34, "flow_id": "flow-d8c7723c09173888600b3243", "packets": 2, "transport": "udp", "last_frame": 1320, "first_frame": 1319, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 65381, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1566329681.345121", "responder_bytes": 151, "first_seen_epoch": "1566329681.344864" }, { "bytes": 128, "stream": 35, "flow_id": "flow-4f200bd5c1afefdbb5f803e2", "packets": 2, "transport": "udp", "last_frame": 1323, "first_frame": 1321, "initiator_ip": "10.8.20.101", "responder_ip": "224.0.0.252", "initiator_port": 63458, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1566329681.444587", "responder_bytes": 0, "first_seen_epoch": "1566329681.345756" }, { "bytes": 156, "stream": 36, "flow_id": "flow-3f89f688dc119324dbd87929", "packets": 2, "transport": "udp", "last_frame": 1324, "first_frame": 1322, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 64967, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1566329681.506167", "responder_bytes": 86, "first_seen_epoch": "1566329681.389915" }, { "bytes": 232, "stream": 49, "flow_id": "flow-a168fa5d3273278995f305d6", "packets": 4, "transport": "tcp", "last_frame": 1361, "first_frame": 1325, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.6.174", "initiator_port": 49205, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1566329682.467792", "responder_bytes": 58, "first_seen_epoch": "1566329681.509747" }, { "bytes": 3127, "stream": 50, "flow_id": "flow-fc5101cebc15e0edfd496326", "packets": 9, "transport": "tcp", "last_frame": 1362, "first_frame": 1326, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.6.174", "initiator_port": 49206, "responder_port": 80, "initiator_bytes": 1009, "last_seen_epoch": "1566329682.46791", "responder_bytes": 2118, "first_seen_epoch": "1566329681.509899" }, { "bytes": 164, "stream": 37, "flow_id": "flow-d23073c70ed2b6f6ec7dab9d", "packets": 2, "transport": "udp", "last_frame": 1338, "first_frame": 1336, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 55481, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1566329681.649446", "responder_bytes": 90, "first_seen_epoch": "1566329681.632531" }, { "bytes": 4879, "stream": 51, "flow_id": "flow-a018dd8d8eb761cd23166fe9", "packets": 10, "transport": "tcp", "last_frame": 1363, "first_frame": 1339, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.9.132", "initiator_port": 49207, "responder_port": 80, "initiator_bytes": 1114, "last_seen_epoch": "1566329682.468143", "responder_bytes": 3765, "first_seen_epoch": "1566329681.650029" }, { "bytes": 8175, "stream": 52, "flow_id": "flow-f6e95dcaa61912797ea70d2e", "packets": 13, "transport": "tcp", "last_frame": 1364, "first_frame": 1340, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.9.132", "initiator_port": 49208, "responder_port": 80, "initiator_bytes": 1132, "last_seen_epoch": "1566329682.468449", "responder_bytes": 7043, "first_seen_epoch": "1566329681.650112" }, { "bytes": 154, "stream": 38, "flow_id": "flow-91876cca9574a765bfc765be", "packets": 2, "transport": "udp", "last_frame": 1368, "first_frame": 1367, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 54444, "responder_port": 53, "initiator_bytes": 69, "last_seen_epoch": "1566329702.707409", "responder_bytes": 85, "first_seen_epoch": "1566329702.684441" }, { "bytes": 6675, "stream": 53, "flow_id": "flow-bc7076c847de9749e23ba249", "packets": 19, "transport": "tcp", "last_frame": 1438, "first_frame": 1369, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.6.133", "initiator_port": 49209, "responder_port": 443, "initiator_bytes": 1322, "last_seen_epoch": "1566329703.752056", "responder_bytes": 5353, "first_seen_epoch": "1566329702.710994" }, { "bytes": 3840, "stream": 54, "flow_id": "flow-9fea25e0e5cedab06a6e25bd", "packets": 13, "transport": "tcp", "last_frame": 1439, "first_frame": 1370, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.6.133", "initiator_port": 49210, "responder_port": 443, "initiator_bytes": 691, "last_seen_epoch": "1566329703.752213", "responder_bytes": 3149, "first_seen_epoch": "1566329702.71118" }, { "bytes": 8189, "stream": 55, "flow_id": "flow-2f8bc2627796dae99a3413a1", "packets": 19, "transport": "tcp", "last_frame": 1441, "first_frame": 1399, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.9.132", "initiator_port": 49211, "responder_port": 443, "initiator_bytes": 1596, "last_seen_epoch": "1566329703.752902", "responder_bytes": 6593, "first_seen_epoch": "1566329702.897857" }, { "bytes": 11487, "stream": 56, "flow_id": "flow-601b8cc20b06293c4e651e0c", "packets": 21, "transport": "tcp", "last_frame": 1440, "first_frame": 1400, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.9.132", "initiator_port": 49212, "responder_port": 443, "initiator_bytes": 1560, "last_seen_epoch": "1566329703.752471", "responder_bytes": 9927, "first_seen_epoch": "1566329702.898083" }, { "bytes": 170, "stream": 39, "flow_id": "flow-b1875ec1f2a2b4243b8ac8a9", "packets": 2, "transport": "udp", "last_frame": 1445, "first_frame": 1444, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 60473, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1566329723.982026", "responder_bytes": 93, "first_seen_epoch": "1566329723.938616" }, { "bytes": 232, "stream": 57, "flow_id": "flow-c103fe48d2575954b36ccbca", "packets": 4, "transport": "tcp", "last_frame": 1959, "first_frame": 1446, "initiator_ip": "10.8.20.101", "responder_ip": "94.103.86.146", "initiator_port": 49213, "responder_port": 80, "initiator_bytes": 174, "last_seen_epoch": "1566329728.995678", "responder_bytes": 58, "first_seen_epoch": "1566329723.984034" }, { "bytes": 532467, "stream": 58, "flow_id": "flow-fb0dddfb491d67ea20248474", "packets": 509, "transport": "tcp", "last_frame": 1960, "first_frame": 1447, "initiator_ip": "10.8.20.101", "responder_ip": "94.103.86.146", "initiator_port": 49214, "responder_port": 80, "initiator_bytes": 9969, "last_seen_epoch": "1566329728.995839", "responder_bytes": 522498, "first_seen_epoch": "1566329723.98411" }, { "bytes": 178, "stream": 40, "flow_id": "flow-7bc69df50496e57759e7b1b9", "packets": 2, "transport": "udp", "last_frame": 1964, "first_frame": 1963, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 59481, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1566329796.089726", "responder_bytes": 97, "first_seen_epoch": "1566329796.056738" }, { "bytes": 209, "stream": 41, "flow_id": "flow-1034b4392a893db5cac3f624", "packets": 2, "transport": "udp", "last_frame": 1966, "first_frame": 1965, "initiator_ip": "10.8.20.101", "responder_ip": "208.67.222.222", "initiator_port": 59482, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1566329796.110202", "responder_bytes": 122, "first_seen_epoch": "1566329796.096059" }, { "bytes": 249, "stream": 42, "flow_id": "flow-b024c430101c4a37f5f810ac", "packets": 2, "transport": "udp", "last_frame": 1968, "first_frame": 1967, "initiator_ip": "10.8.20.101", "responder_ip": "208.67.222.222", "initiator_port": 59483, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1566329796.162199", "responder_bytes": 160, "first_seen_epoch": "1566329796.110953" }, { "bytes": 168, "stream": 43, "flow_id": "flow-f0c3fcbec979fee9ba9eb9fb", "packets": 2, "transport": "udp", "last_frame": 1970, "first_frame": 1969, "initiator_ip": "10.8.20.101", "responder_ip": "208.67.222.222", "initiator_port": 59485, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1566329796.306864", "responder_bytes": 92, "first_seen_epoch": "1566329796.285649" }, { "bytes": 7889, "stream": 59, "flow_id": "flow-e8565adc5862000bbd2d566f", "packets": 23, "transport": "tcp", "last_frame": 2103, "first_frame": 1972, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.6.174", "initiator_port": 49215, "responder_port": 443, "initiator_bytes": 1631, "last_seen_epoch": "1566329914.833249", "responder_bytes": 6258, "first_seen_epoch": "1566329796.439433" }, { "bytes": 6917, "stream": 60, "flow_id": "flow-65396dbf09121490b4aa91b8", "packets": 22, "transport": "tcp", "last_frame": 2101, "first_frame": 1991, "initiator_ip": "10.8.20.101", "responder_ip": "172.217.6.133", "initiator_port": 49216, "responder_port": 443, "initiator_bytes": 1376, "last_seen_epoch": "1566329914.810994", "responder_bytes": 5541, "first_seen_epoch": "1566329796.545838" }, { "bytes": 172, "stream": 44, "flow_id": "flow-dfd7cac3eda394caa00bedbe", "packets": 2, "transport": "udp", "last_frame": 2012, "first_frame": 2011, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 52157, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1566329806.728922", "responder_bytes": 94, "first_seen_epoch": "1566329806.7047" }, { "bytes": 3652, "stream": 61, "flow_id": "flow-223b3a351b60270c95cc758f", "packets": 20, "transport": "tcp", "last_frame": 2095, "first_frame": 2013, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49217, "responder_port": 443, "initiator_bytes": 1881, "last_seen_epoch": "1566329914.750903", "responder_bytes": 1771, "first_seen_epoch": "1566329806.729474" }, { "bytes": 452, "stream": 45, "flow_id": "flow-d816375cd5483aab825a0652", "packets": 2, "transport": "udp", "last_frame": 2025, "first_frame": 2024, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 55183, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1566329807.574008", "responder_bytes": 362, "first_seen_epoch": "1566329807.511295" }, { "bytes": 61769, "stream": 62, "flow_id": "flow-8c9d46cb605d511fa43028a4", "packets": 59, "transport": "tcp", "last_frame": 2088, "first_frame": 2026, "initiator_ip": "10.8.20.101", "responder_ip": "23.200.143.72", "initiator_port": 49218, "responder_port": 80, "initiator_bytes": 1093, "last_seen_epoch": "1566329867.63827", "responder_bytes": 60676, "first_seen_epoch": "1566329807.576146" }, { "bytes": 3444, "stream": 63, "flow_id": "flow-aedbc6c828a30f502f28bb24", "packets": 20, "transport": "tcp", "last_frame": 3106, "first_frame": 2118, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49219, "responder_port": 443, "initiator_bytes": 1417, "last_seen_epoch": "1566330209.719512", "responder_bytes": 2027, "first_seen_epoch": "1566330096.547135" }, { "bytes": 180, "stream": 46, "flow_id": "flow-b8247ca74d81ac28b6b9c7df", "packets": 2, "transport": "udp", "last_frame": 2134, "first_frame": 2133, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 58097, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1566330099.301598", "responder_bytes": 98, "first_seen_epoch": "1566330098.980354" }, { "bytes": 887, "stream": 64, "flow_id": "flow-907b8a26e976c160b7dde206", "packets": 9, "transport": "tcp", "last_frame": 2143, "first_frame": 2135, "initiator_ip": "10.8.20.101", "responder_ip": "139.198.5.65", "initiator_port": 49220, "responder_port": 80, "initiator_bytes": 497, "last_seen_epoch": "1566330099.672892", "responder_bytes": 390, "first_seen_epoch": "1566330099.302355" }, { "bytes": 874366, "stream": 65, "flow_id": "flow-f0ec7bab935ee073cdc2c874", "packets": 844, "transport": "tcp", "last_frame": 2987, "first_frame": 2144, "initiator_ip": "10.8.20.101", "responder_ip": "139.198.5.65", "initiator_port": 49221, "responder_port": 443, "initiator_bytes": 13579, "last_seen_epoch": "1566330101.749095", "responder_bytes": 860787, "first_seen_epoch": "1566330099.673285" }, { "bytes": 10580, "stream": 66, "flow_id": "flow-8932e5611fcdc128f6cf1d23", "packets": 39, "transport": "tcp", "last_frame": 3103, "first_frame": 2988, "initiator_ip": "10.8.20.101", "responder_ip": "191.37.181.152", "initiator_port": 49222, "responder_port": 449, "initiator_bytes": 3513, "last_seen_epoch": "1566330205.294049", "responder_bytes": 7067, "first_seen_epoch": "1566330131.331841" }, { "bytes": 154, "stream": 47, "flow_id": "flow-dc8d90319095f199310e26e4", "packets": 2, "transport": "udp", "last_frame": 3001, "first_frame": 3000, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 52316, "responder_port": 53, "initiator_bytes": 69, "last_seen_epoch": "1566330133.355663", "responder_bytes": 85, "first_seen_epoch": "1566330133.296128" }, { "bytes": 6893, "stream": 67, "flow_id": "flow-3d91f88194331213bc23fc99", "packets": 23, "transport": "tcp", "last_frame": 3025, "first_frame": 3002, "initiator_ip": "10.8.20.101", "responder_ip": "185.248.87.88", "initiator_port": 49223, "responder_port": 443, "initiator_bytes": 1086, "last_seen_epoch": "1566330133.56399", "responder_bytes": 5807, "first_seen_epoch": "1566330133.358851" }, { "bytes": 7303, "stream": 68, "flow_id": "flow-2feb143f61f469dd9893c26d", "packets": 32, "transport": "tcp", "last_frame": 3112, "first_frame": 3046, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49224, "responder_port": 443, "initiator_bytes": 2691, "last_seen_epoch": "1566330213.570291", "responder_bytes": 4612, "first_seen_epoch": "1566330143.254969" }, { "bytes": 248, "stream": 48, "flow_id": "flow-7e21184b932a98bec6a2aca0", "packets": 2, "transport": "udp", "last_frame": 3068, "first_frame": 3067, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 61169, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1566330147.374893", "responder_bytes": 156, "first_seen_epoch": "1566330147.30437" }, { "bytes": 255, "stream": 49, "flow_id": "flow-95d08c139b125ff0fa20da62", "packets": 2, "transport": "udp", "last_frame": 3071, "first_frame": 3069, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 53363, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1566330147.443688", "responder_bytes": 164, "first_seen_epoch": "1566330147.376289" }, { "bytes": 256, "stream": 50, "flow_id": "flow-7cfaa0c53697d11a80224de8", "packets": 2, "transport": "udp", "last_frame": 3073, "first_frame": 3072, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 60142, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1566330147.516641", "responder_bytes": 158, "first_seen_epoch": "1566330147.4445" }, { "bytes": 264, "stream": 51, "flow_id": "flow-c163b1bf1250064ac4be6271", "packets": 2, "transport": "udp", "last_frame": 3075, "first_frame": 3074, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 57426, "responder_port": 53, "initiator_bytes": 98, "last_seen_epoch": "1566330147.580034", "responder_bytes": 166, "first_seen_epoch": "1566330147.518389" }, { "bytes": 248, "stream": 52, "flow_id": "flow-d181b6328522a30e2e426687", "packets": 2, "transport": "udp", "last_frame": 3077, "first_frame": 3076, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 63954, "responder_port": 53, "initiator_bytes": 96, "last_seen_epoch": "1566330147.609808", "responder_bytes": 152, "first_seen_epoch": "1566330147.581274" }, { "bytes": 6265, "stream": 69, "flow_id": "flow-b8e2292822d16787d0041204", "packets": 22, "transport": "tcp", "last_frame": 3204, "first_frame": 3183, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49225, "responder_port": 445, "initiator_bytes": 4567, "last_seen_epoch": "1566330366.559768", "responder_bytes": 1698, "first_seen_epoch": "1566330350.553176" }, { "bytes": 3193, "stream": 70, "flow_id": "flow-043017f22622b763622a300c", "packets": 19, "transport": "tcp", "last_frame": 4026, "first_frame": 3216, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49226, "responder_port": 443, "initiator_bytes": 1363, "last_seen_epoch": "1566330414.428855", "responder_bytes": 1830, "first_seen_epoch": "1566330396.543366" }, { "bytes": 3492, "stream": 71, "flow_id": "flow-24c51eb1677be1faa233352c", "packets": 20, "transport": "tcp", "last_frame": 4061, "first_frame": 3231, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49227, "responder_port": 443, "initiator_bytes": 1465, "last_seen_epoch": "1566330509.708876", "responder_bytes": 2027, "first_seen_epoch": "1566330400.041481" }, { "bytes": 170, "stream": 53, "flow_id": "flow-85eff8539d038dd9a69dd2c0", "packets": 2, "transport": "udp", "last_frame": 3247, "first_frame": 3246, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 50516, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1566330403.34448", "responder_bytes": 93, "first_seen_epoch": "1566330403.320857" }, { "bytes": 1385, "stream": 72, "flow_id": "flow-8d441ba8c32153614b4846b8", "packets": 11, "transport": "tcp", "last_frame": 4055, "first_frame": 3248, "initiator_ip": "10.8.20.101", "responder_ip": "206.189.74.47", "initiator_port": 49228, "responder_port": 80, "initiator_bytes": 546, "last_seen_epoch": "1566330509.707726", "responder_bytes": 839, "first_seen_epoch": "1566330403.345053" }, { "bytes": 802846, "stream": 73, "flow_id": "flow-39204ee010d7dfdc2a19b2b9", "packets": 767, "transport": "tcp", "last_frame": 4053, "first_frame": 3255, "initiator_ip": "10.8.20.101", "responder_ip": "206.189.74.47", "initiator_port": 49229, "responder_port": 443, "initiator_bytes": 13442, "last_seen_epoch": "1566330509.707501", "responder_bytes": 789404, "first_seen_epoch": "1566330403.447933" }, { "bytes": 3636, "stream": 74, "flow_id": "flow-527961f5f4f580d50066eab5", "packets": 20, "transport": "tcp", "last_frame": 4058, "first_frame": 4024, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49230, "responder_port": 443, "initiator_bytes": 1865, "last_seen_epoch": "1566330509.708405", "responder_bytes": 1771, "first_seen_epoch": "1566330414.220957" }, { "bytes": 2875412, "stream": 75, "flow_id": "flow-30379948ac9517cbbb422ddb", "packets": 2519, "transport": "tcp", "last_frame": 13804, "first_frame": 4065, "initiator_ip": "10.8.20.101", "responder_ip": "185.117.75.41", "initiator_port": 49231, "responder_port": 447, "initiator_bytes": 35171, "last_seen_epoch": "1566330713.395079", "responder_bytes": 2840241, "first_seen_epoch": "1566330548.87944" }, { "bytes": 203387, "stream": 76, "flow_id": "flow-ba70fddccc232a3f6effdb91", "packets": 301, "transport": "tcp", "last_frame": 14292, "first_frame": 4095, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49232, "responder_port": 443, "initiator_bytes": 41802, "last_seen_epoch": "1566330736.711186", "responder_bytes": 161585, "first_seen_epoch": "1566330549.629883" }, { "bytes": 3401, "stream": 77, "flow_id": "flow-49e2a8b448af3d85e34d3d6a", "packets": 19, "transport": "tcp", "last_frame": 4793, "first_frame": 4588, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49233, "responder_port": 443, "initiator_bytes": 1683, "last_seen_epoch": "1566330562.902049", "responder_bytes": 1718, "first_seen_epoch": "1566330556.472781" }, { "bytes": 24925, "stream": 78, "flow_id": "flow-51b451a0ea670e2d0b436e94", "packets": 129, "transport": "tcp", "last_frame": 16492, "first_frame": 4742, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49234, "responder_port": 443, "initiator_bytes": 14511, "last_seen_epoch": "1566330823.492167", "responder_bytes": 10414, "first_seen_epoch": "1566330558.737844" }, { "bytes": 3497, "stream": 79, "flow_id": "flow-db02ff857609a1fe4c673d77", "packets": 19, "transport": "tcp", "last_frame": 5984, "first_frame": 4763, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49235, "responder_port": 443, "initiator_bytes": 1779, "last_seen_epoch": "1566330564.477193", "responder_bytes": 1718, "first_seen_epoch": "1566330561.149308" }, { "bytes": 3401, "stream": 80, "flow_id": "flow-2113d12191429ef894a6f284", "packets": 19, "transport": "tcp", "last_frame": 8734, "first_frame": 4785, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49236, "responder_port": 443, "initiator_bytes": 1683, "last_seen_epoch": "1566330626.863494", "responder_bytes": 1718, "first_seen_epoch": "1566330562.687626" }, { "bytes": 3513, "stream": 81, "flow_id": "flow-aaba4ba356399fb706f2d28d", "packets": 19, "transport": "tcp", "last_frame": 8733, "first_frame": 5978, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49237, "responder_port": 443, "initiator_bytes": 1795, "last_seen_epoch": "1566330626.863467", "responder_bytes": 1718, "first_seen_epoch": "1566330564.263533" }, { "bytes": 9072, "stream": 54, "flow_id": "flow-650534f576e7765fefd1e264", "packets": 42, "transport": "udp", "last_frame": 17486, "first_frame": 6074, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 9072, "last_seen_epoch": "1566330837.064033", "responder_bytes": 0, "first_seen_epoch": "1566330592.428796" }, { "bytes": 104, "stream": 55, "flow_id": "flow-02cdc494d3eebcbae790ab7a", "packets": 1, "transport": "udp", "last_frame": 6076, "first_frame": 6076, "initiator_ip": "10.8.20.8", "responder_ip": "10.8.20.101", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 104, "last_seen_epoch": "1566330592.429664", "responder_bytes": 0, "first_seen_epoch": "1566330592.429664" }, { "bytes": 9072, "stream": 56, "flow_id": "flow-e57b3a9ad51bbf27fcb963b0", "packets": 42, "transport": "udp", "last_frame": 17487, "first_frame": 6077, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 9072, "last_seen_epoch": "1566330837.064189", "responder_bytes": 0, "first_seen_epoch": "1566330592.430291" }, { "bytes": 885931, "stream": 82, "flow_id": "flow-982dc9648994e165a38de565", "packets": 746, "transport": "tcp", "last_frame": 11427, "first_frame": 6109, "initiator_ip": "10.8.20.101", "responder_ip": "185.183.98.232", "initiator_port": 49238, "responder_port": 80, "initiator_bytes": 8566, "last_seen_epoch": "1566330662.602407", "responder_bytes": 877365, "first_seen_epoch": "1566330597.1238" }, { "bytes": 1376, "stream": 83, "flow_id": "flow-915a77c89b0a5f48a6288b54", "packets": 12, "transport": "tcp", "last_frame": 7815, "first_frame": 6887, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49239, "responder_port": 135, "initiator_bytes": 718, "last_seen_epoch": "1566330622.484486", "responder_bytes": 658, "first_seen_epoch": "1566330612.471338" }, { "bytes": 3032, "stream": 84, "flow_id": "flow-b4e8ce9e5098d2caf609da7b", "packets": 12, "transport": "tcp", "last_frame": 7814, "first_frame": 6894, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49240, "responder_port": 49158, "initiator_bytes": 1638, "last_seen_epoch": "1566330622.484432", "responder_bytes": 1394, "first_seen_epoch": "1566330612.47361" }, { "bytes": 1448, "stream": 85, "flow_id": "flow-3bdfe4a831ba745839a1a7cd", "packets": 11, "transport": "tcp", "last_frame": 6930, "first_frame": 6918, "initiator_ip": "10.8.20.101", "responder_ip": "170.238.117.187", "initiator_port": 49241, "responder_port": 8082, "initiator_bytes": 1035, "last_seen_epoch": "1566330617.34312", "responder_bytes": 413, "first_seen_epoch": "1566330616.40594" }, { "bytes": 1497, "stream": 86, "flow_id": "flow-a83e508dc96be68f6dc5fccb", "packets": 11, "transport": "tcp", "last_frame": 7746, "first_frame": 7012, "initiator_ip": "10.8.20.101", "responder_ip": "170.238.117.187", "initiator_port": 49242, "responder_port": 8082, "initiator_bytes": 1084, "last_seen_epoch": "1566330619.790342", "responder_bytes": 413, "first_seen_epoch": "1566330618.942574" }, { "bytes": 1436, "stream": 87, "flow_id": "flow-d6bfb4a52f56bdef5fa9d424", "packets": 11, "transport": "tcp", "last_frame": 7863, "first_frame": 7753, "initiator_ip": "10.8.20.101", "responder_ip": "170.238.117.187", "initiator_port": 49243, "responder_port": 8082, "initiator_bytes": 1023, "last_seen_epoch": "1566330622.820033", "responder_bytes": 413, "first_seen_epoch": "1566330621.952105" }, { "bytes": 886815, "stream": 88, "flow_id": "flow-d2df9342a773a8fb1f6be076", "packets": 761, "transport": "tcp", "last_frame": 11989, "first_frame": 7762, "initiator_ip": "10.8.20.101", "responder_ip": "185.183.98.232", "initiator_port": 49244, "responder_port": 80, "initiator_bytes": 9558, "last_seen_epoch": "1566330685.692983", "responder_bytes": 877257, "first_seen_epoch": "1566330621.960318" }, { "bytes": 9747, "stream": 89, "flow_id": "flow-ba952264e15fdfb42633dede", "packets": 55, "transport": "tcp", "last_frame": 16040, "first_frame": 8342, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49245, "responder_port": 443, "initiator_bytes": 5268, "last_seen_epoch": "1566330802.692088", "responder_bytes": 4479, "first_seen_epoch": "1566330624.963678" }, { "bytes": 120, "stream": 90, "flow_id": "flow-a6e279ca1b8a2a44d3ac20ef", "packets": 2, "transport": "tcp", "last_frame": 8568, "first_frame": 8567, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.1", "initiator_port": 49247, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1566330625.689361", "responder_bytes": 54, "first_seen_epoch": "1566330625.689313" }, { "bytes": 348, "stream": 91, "flow_id": "flow-4f950d861e52a158a20af9f2", "packets": 6, "transport": "tcp", "last_frame": 8574, "first_frame": 8569, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49249, "responder_port": 445, "initiator_bytes": 174, "last_seen_epoch": "1566330625.690716", "responder_bytes": 174, "first_seen_epoch": "1566330625.689621" }, { "bytes": 53977, "stream": 92, "flow_id": "flow-75870e51d34a8adeeab0e3be", "packets": 208, "transport": "tcp", "last_frame": 8818, "first_frame": 8575, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49252, "responder_port": 445, "initiator_bytes": 30814, "last_seen_epoch": "1566330630.929147", "responder_bytes": 23163, "first_seen_epoch": "1566330625.691096" }, { "bytes": 120, "stream": 93, "flow_id": "flow-1fc05e087bdeffd8923441dd", "packets": 2, "transport": "tcp", "last_frame": 8722, "first_frame": 8721, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.1", "initiator_port": 49247, "responder_port": 445, "initiator_bytes": 66, "last_seen_epoch": "1566330626.194663", "responder_bytes": 54, "first_seen_epoch": "1566330626.194587" }, { "bytes": 140509, "stream": 94, "flow_id": "flow-63917dea300c62d08b021331", "packets": 625, "transport": "tcp", "last_frame": 10479, "first_frame": 8819, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49506, "responder_port": 445, "initiator_bytes": 85937, "last_seen_epoch": "1566330656.180286", "responder_bytes": 54572, "first_seen_epoch": "1566330630.929489" }, { "bytes": 1728, "stream": 95, "flow_id": "flow-af2639769b94223e07ac6dc4", "packets": 14, "transport": "tcp", "last_frame": 12321, "first_frame": 8966, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49507, "responder_port": 135, "initiator_bytes": 940, "last_seen_epoch": "1566330692.453412", "responder_bytes": 788, "first_seen_epoch": "1566330632.470025" }, { "bytes": 6648, "stream": 96, "flow_id": "flow-5dd0ac8eb4b0a598be79e1ea", "packets": 26, "transport": "tcp", "last_frame": 12318, "first_frame": 8973, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49508, "responder_port": 49155, "initiator_bytes": 4151, "last_seen_epoch": "1566330692.452917", "responder_bytes": 2497, "first_seen_epoch": "1566330632.475195" }, { "bytes": 308, "stream": 57, "flow_id": "flow-7c78b68661494c3afdbe7784", "packets": 2, "transport": "udp", "last_frame": 8997, "first_frame": 8996, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 60600, "responder_port": 53, "initiator_bytes": 124, "last_seen_epoch": "1566330632.497685", "responder_bytes": 184, "first_seen_epoch": "1566330632.49739" }, { "bytes": 400, "stream": 58, "flow_id": "flow-3d61e2b557ebfc79aab93f29", "packets": 2, "transport": "udp", "last_frame": 8999, "first_frame": 8998, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 60601, "responder_port": 389, "initiator_bytes": 176, "last_seen_epoch": "1566330632.498811", "responder_bytes": 224, "first_seen_epoch": "1566330632.498582" }, { "bytes": 273186, "stream": 97, "flow_id": "flow-f39c3d014b58e692b60b029e", "packets": 219, "transport": "tcp", "last_frame": 9397, "first_frame": 9000, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49509, "responder_port": 3268, "initiator_bytes": 4821, "last_seen_epoch": "1566330632.746457", "responder_bytes": 268365, "first_seen_epoch": "1566330632.607878" }, { "bytes": 323, "stream": 59, "flow_id": "flow-7456195d4053c9547c7e9a5f", "packets": 2, "transport": "udp", "last_frame": 9220, "first_frame": 9219, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 63404, "responder_port": 53, "initiator_bytes": 126, "last_seen_epoch": "1566330632.699591", "responder_bytes": 197, "first_seen_epoch": "1566330632.699346" }, { "bytes": 261, "stream": 60, "flow_id": "flow-6715ca144a21c7152dc8d789", "packets": 2, "transport": "udp", "last_frame": 9222, "first_frame": 9221, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 53590, "responder_port": 53, "initiator_bytes": 95, "last_seen_epoch": "1566330632.700045", "responder_bytes": 166, "first_seen_epoch": "1566330632.699879" }, { "bytes": 64106, "stream": 98, "flow_id": "flow-43d7aa3b20861def3595dd39", "packets": 175, "transport": "tcp", "last_frame": 18394, "first_frame": 9223, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49510, "responder_port": 389, "initiator_bytes": 19787, "last_seen_epoch": "1566331548.856533", "responder_bytes": 44319, "first_seen_epoch": "1566330632.700631" }, { "bytes": 225, "stream": 61, "flow_id": "flow-d5ae0efc20d130d943764604", "packets": 2, "transport": "udp", "last_frame": 9399, "first_frame": 9398, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 63468, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1566330632.760705", "responder_bytes": 148, "first_seen_epoch": "1566330632.760456" }, { "bytes": 152, "stream": 62, "flow_id": "flow-7b389617e12f9ae3915a6d12", "packets": 2, "transport": "udp", "last_frame": 9401, "first_frame": 9400, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 50092, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1566330632.778985", "responder_bytes": 76, "first_seen_epoch": "1566330632.761022" }, { "bytes": 128, "stream": 63, "flow_id": "flow-69f1520392668e9e49ac2461", "packets": 2, "transport": "udp", "last_frame": 9404, "first_frame": 9402, "initiator_ip": "10.8.20.101", "responder_ip": "224.0.0.252", "initiator_port": 56820, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1566330632.886808", "responder_bytes": 0, "first_seen_epoch": "1566330632.77952" }, { "bytes": 5969, "stream": 99, "flow_id": "flow-23a894033226c31f898a3bd4", "packets": 19, "transport": "tcp", "last_frame": 14799, "first_frame": 9403, "initiator_ip": "10.8.20.101", "responder_ip": "170.238.117.187", "initiator_port": 49511, "responder_port": 8082, "initiator_bytes": 5359, "last_seen_epoch": "1566330752.763124", "responder_bytes": 610, "first_seen_epoch": "1566330632.7797" }, { "bytes": 184, "stream": 64, "flow_id": "flow-3cac861cd14932f093baa368", "packets": 2, "transport": "udp", "last_frame": 10006, "first_frame": 10005, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 61223, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1566330654.942042", "responder_bytes": 100, "first_seen_epoch": "1566330654.941768" }, { "bytes": 8307, "stream": 100, "flow_id": "flow-6c16e0851094ae0a7daa8a1a", "packets": 23, "transport": "tcp", "last_frame": 10362, "first_frame": 10007, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49512, "responder_port": 3268, "initiator_bytes": 3488, "last_seen_epoch": "1566330655.005757", "responder_bytes": 4819, "first_seen_epoch": "1566330654.944211" }, { "bytes": 184, "stream": 65, "flow_id": "flow-434c63bdcf723edeb70ddd32", "packets": 2, "transport": "udp", "last_frame": 10027, "first_frame": 10026, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 58727, "responder_port": 53, "initiator_bytes": 84, "last_seen_epoch": "1566330654.97732", "responder_bytes": 100, "first_seen_epoch": "1566330654.977069" }, { "bytes": 72309, "stream": 101, "flow_id": "flow-048bda2afe492cae1ff2a3f0", "packets": 86, "transport": "tcp", "last_frame": 10357, "first_frame": 10028, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49513, "responder_port": 445, "initiator_bytes": 70132, "last_seen_epoch": "1566330654.999113", "responder_bytes": 2177, "first_seen_epoch": "1566330654.977732" }, { "bytes": 642, "stream": 102, "flow_id": "flow-2047603d7d48b3b690141d8e", "packets": 9, "transport": "tcp", "last_frame": 10358, "first_frame": 10039, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49514, "responder_port": 135, "initiator_bytes": 354, "last_seen_epoch": "1566330655.00089", "responder_bytes": 288, "first_seen_epoch": "1566330654.979593" }, { "bytes": 1148, "stream": 103, "flow_id": "flow-5486306ba49c76c8769737c3", "packets": 10, "transport": "tcp", "last_frame": 10177, "first_frame": 10108, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49515, "responder_port": 445, "initiator_bytes": 418, "last_seen_epoch": "1566330654.991547", "responder_bytes": 730, "first_seen_epoch": "1566330654.982649" }, { "bytes": 4172, "stream": 104, "flow_id": "flow-03ddec35b0983d6008b74e1c", "packets": 12, "transport": "tcp", "last_frame": 10319, "first_frame": 10115, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49516, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997475", "responder_bytes": 282, "first_seen_epoch": "1566330654.983481" }, { "bytes": 4172, "stream": 105, "flow_id": "flow-a6b9c9ef6082573092b08de4", "packets": 12, "transport": "tcp", "last_frame": 10320, "first_frame": 10119, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49517, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997526", "responder_bytes": 282, "first_seen_epoch": "1566330654.983818" }, { "bytes": 4172, "stream": 106, "flow_id": "flow-2c52164a4606f7ec40efaf46", "packets": 12, "transport": "tcp", "last_frame": 10321, "first_frame": 10123, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49518, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997575", "responder_bytes": 282, "first_seen_epoch": "1566330654.984146" }, { "bytes": 4172, "stream": 107, "flow_id": "flow-ae6f61c926d5796c328ebf1e", "packets": 12, "transport": "tcp", "last_frame": 10322, "first_frame": 10127, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49519, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997624", "responder_bytes": 282, "first_seen_epoch": "1566330654.984479" }, { "bytes": 4172, "stream": 108, "flow_id": "flow-933459e83ed37e635889df4a", "packets": 12, "transport": "tcp", "last_frame": 10323, "first_frame": 10131, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49520, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997676", "responder_bytes": 282, "first_seen_epoch": "1566330654.984799" }, { "bytes": 4172, "stream": 109, "flow_id": "flow-18b951072736c1c8db5e0e5a", "packets": 12, "transport": "tcp", "last_frame": 10326, "first_frame": 10135, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49521, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997726", "responder_bytes": 282, "first_seen_epoch": "1566330654.98512" }, { "bytes": 4172, "stream": 110, "flow_id": "flow-93ae7ffbdefd67317c07fd74", "packets": 12, "transport": "tcp", "last_frame": 10345, "first_frame": 10139, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49522, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998351", "responder_bytes": 282, "first_seen_epoch": "1566330654.985492" }, { "bytes": 4172, "stream": 111, "flow_id": "flow-569fee90b8a231642ee4b250", "packets": 12, "transport": "tcp", "last_frame": 10346, "first_frame": 10143, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49523, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998406", "responder_bytes": 282, "first_seen_epoch": "1566330654.985832" }, { "bytes": 4172, "stream": 112, "flow_id": "flow-bf5dacbe572bb222d71e8f42", "packets": 12, "transport": "tcp", "last_frame": 10347, "first_frame": 10147, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49524, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998458", "responder_bytes": 282, "first_seen_epoch": "1566330654.986149" }, { "bytes": 4172, "stream": 113, "flow_id": "flow-5d86d6644dce3ca7d0c2ccd7", "packets": 12, "transport": "tcp", "last_frame": 10348, "first_frame": 10151, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49525, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.99851", "responder_bytes": 282, "first_seen_epoch": "1566330654.986469" }, { "bytes": 4172, "stream": 114, "flow_id": "flow-5d48c5fa08c2c8b7450d2e5e", "packets": 12, "transport": "tcp", "last_frame": 10349, "first_frame": 10155, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49526, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998561", "responder_bytes": 282, "first_seen_epoch": "1566330654.986804" }, { "bytes": 4172, "stream": 115, "flow_id": "flow-ddf8edad70fe80ef0d8aca58", "packets": 12, "transport": "tcp", "last_frame": 10350, "first_frame": 10159, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49527, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998637", "responder_bytes": 282, "first_seen_epoch": "1566330654.987124" }, { "bytes": 4172, "stream": 116, "flow_id": "flow-62f792eb1dfc8e3aa307b28c", "packets": 12, "transport": "tcp", "last_frame": 10351, "first_frame": 10163, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49528, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998695", "responder_bytes": 282, "first_seen_epoch": "1566330654.988898" }, { "bytes": 1051, "stream": 117, "flow_id": "flow-daa4d61159ea24e83d457f0c", "packets": 10, "transport": "tcp", "last_frame": 10203, "first_frame": 10167, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49529, "responder_port": 445, "initiator_bytes": 418, "last_seen_epoch": "1566330654.993781", "responder_bytes": 633, "first_seen_epoch": "1566330654.990467" }, { "bytes": 4172, "stream": 118, "flow_id": "flow-b96efbc4a156974f7a30ec34", "packets": 12, "transport": "tcp", "last_frame": 10318, "first_frame": 10176, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49530, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.997424", "responder_bytes": 282, "first_seen_epoch": "1566330654.991505" }, { "bytes": 4172, "stream": 119, "flow_id": "flow-d002b919b765eee6351b76a1", "packets": 12, "transport": "tcp", "last_frame": 10352, "first_frame": 10181, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49531, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998756", "responder_bytes": 282, "first_seen_epoch": "1566330654.991849" }, { "bytes": 4172, "stream": 120, "flow_id": "flow-bf83856f52914577d00d3e74", "packets": 12, "transport": "tcp", "last_frame": 10353, "first_frame": 10185, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49532, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998815", "responder_bytes": 282, "first_seen_epoch": "1566330654.992409" }, { "bytes": 4172, "stream": 121, "flow_id": "flow-a7eb3d9bfa06ffb694d8da48", "packets": 12, "transport": "tcp", "last_frame": 10354, "first_frame": 10189, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49533, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998877", "responder_bytes": 282, "first_seen_epoch": "1566330654.99273" }, { "bytes": 4172, "stream": 122, "flow_id": "flow-cf5caa76e4d03a5a7496e0ed", "packets": 12, "transport": "tcp", "last_frame": 10355, "first_frame": 10193, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49534, "responder_port": 445, "initiator_bytes": 3890, "last_seen_epoch": "1566330654.998928", "responder_bytes": 282, "first_seen_epoch": "1566330654.993046" }, { "bytes": 883400, "stream": 123, "flow_id": "flow-31b6c9f1d67ef6c1b687f970", "packets": 756, "transport": "tcp", "last_frame": 13942, "first_frame": 10363, "initiator_ip": "10.8.20.101", "responder_ip": "185.183.98.232", "initiator_port": 49557, "responder_port": 80, "initiator_bytes": 9268, "last_seen_epoch": "1566330720.439542", "responder_bytes": 874132, "first_seen_epoch": "1566330655.008282" }, { "bytes": 140425, "stream": 124, "flow_id": "flow-55bb26665f4eb16d7193898d", "packets": 623, "transport": "tcp", "last_frame": 11833, "first_frame": 10477, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49558, "responder_port": 445, "initiator_bytes": 86069, "last_seen_epoch": "1566330681.437535", "responder_bytes": 54356, "first_seen_epoch": "1566330656.180043" }, { "bytes": 2585, "stream": 125, "flow_id": "flow-6d9d9e2e70ac6f5f22a602be", "packets": 19, "transport": "tcp", "last_frame": 11851, "first_frame": 11831, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49559, "responder_port": 445, "initiator_bytes": 1226, "last_seen_epoch": "1566330681.441045", "responder_bytes": 1359, "first_seen_epoch": "1566330681.437142" }, { "bytes": 53954, "stream": 126, "flow_id": "flow-edcfb69b04c46a1494ff1a3a", "packets": 208, "transport": "tcp", "last_frame": 12059, "first_frame": 11850, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49560, "responder_port": 445, "initiator_bytes": 30722, "last_seen_epoch": "1566330686.670589", "responder_bytes": 23232, "first_seen_epoch": "1566330681.440979" }, { "bytes": 104680, "stream": 127, "flow_id": "flow-490cd13fcea32451e2848846", "packets": 439, "transport": "tcp", "last_frame": 12523, "first_frame": 12060, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49561, "responder_port": 445, "initiator_bytes": 62518, "last_seen_epoch": "1566330701.912868", "responder_bytes": 42162, "first_seen_epoch": "1566330686.67089" }, { "bytes": 3508, "stream": 128, "flow_id": "flow-fcc18baa7139b53c862f8248", "packets": 20, "transport": "tcp", "last_frame": 17501, "first_frame": 12441, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49562, "responder_port": 443, "initiator_bytes": 1481, "last_seen_epoch": "1566330846.550299", "responder_bytes": 2027, "first_seen_epoch": "1566330700.037872" }, { "bytes": 79589, "stream": 129, "flow_id": "flow-733edb665fded98a4b154f85", "packets": 329, "transport": "tcp", "last_frame": 13641, "first_frame": 12524, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49563, "responder_port": 445, "initiator_bytes": 46852, "last_seen_epoch": "1566330712.144248", "responder_bytes": 32737, "first_seen_epoch": "1566330701.913187" }, { "bytes": 168, "stream": 66, "flow_id": "flow-7840d678772ca8956626eb60", "packets": 2, "transport": "udp", "last_frame": 12665, "first_frame": 12664, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 51984, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1566330702.513714", "responder_bytes": 92, "first_seen_epoch": "1566330702.438541" }, { "bytes": 796247, "stream": 130, "flow_id": "flow-2cdaf7f9e98fff6741b967bb", "packets": 787, "transport": "tcp", "last_frame": 14291, "first_frame": 12666, "initiator_ip": "10.8.20.101", "responder_ip": "68.183.185.221", "initiator_port": 49564, "responder_port": 80, "initiator_bytes": 14368, "last_seen_epoch": "1566330736.554673", "responder_bytes": 781879, "first_seen_epoch": "1566330702.51451" }, { "bytes": 2682, "stream": 131, "flow_id": "flow-a92279ce0a505bd0f219ac34", "packets": 20, "transport": "tcp", "last_frame": 13661, "first_frame": 13642, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49565, "responder_port": 445, "initiator_bytes": 1280, "last_seen_epoch": "1566330712.146636", "responder_bytes": 1402, "first_seen_epoch": "1566330712.144454" }, { "bytes": 139875, "stream": 132, "flow_id": "flow-306d99a37dc34c404c59aed6", "packets": 614, "transport": "tcp", "last_frame": 14308, "first_frame": 13662, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49566, "responder_port": 445, "initiator_bytes": 85573, "last_seen_epoch": "1566330737.382447", "responder_bytes": 54302, "first_seen_epoch": "1566330712.146852" }, { "bytes": 3614, "stream": 133, "flow_id": "flow-3132ea8f3a96961a15958447", "packets": 19, "transport": "tcp", "last_frame": 17498, "first_frame": 13807, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49567, "responder_port": 443, "initiator_bytes": 1843, "last_seen_epoch": "1566330846.549856", "responder_bytes": 1771, "first_seen_epoch": "1566330716.18064" }, { "bytes": 130090, "stream": 134, "flow_id": "flow-b05e016c97122aa63135ec74", "packets": 557, "transport": "tcp", "last_frame": 14871, "first_frame": 14306, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49568, "responder_port": 445, "initiator_bytes": 78520, "last_seen_epoch": "1566330757.620209", "responder_bytes": 51570, "first_seen_epoch": "1566330737.382088" }, { "bytes": 140155, "stream": 135, "flow_id": "flow-854aa7019e0506b8ac723e49", "packets": 618, "transport": "tcp", "last_frame": 15495, "first_frame": 14872, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49569, "responder_port": 445, "initiator_bytes": 86069, "last_seen_epoch": "1566330782.871829", "responder_bytes": 54086, "first_seen_epoch": "1566330757.620443" }, { "bytes": 2585, "stream": 136, "flow_id": "flow-fe949d33996a6e5329c3eab0", "packets": 19, "transport": "tcp", "last_frame": 15513, "first_frame": 15493, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49570, "responder_port": 445, "initiator_bytes": 1226, "last_seen_epoch": "1566330782.874973", "responder_bytes": 1359, "first_seen_epoch": "1566330782.871526" }, { "bytes": 79442, "stream": 137, "flow_id": "flow-b10f9f00e0526b7c9a21af1d", "packets": 326, "transport": "tcp", "last_frame": 15840, "first_frame": 15512, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49571, "responder_port": 445, "initiator_bytes": 46558, "last_seen_epoch": "1566330793.110171", "responder_bytes": 32884, "first_seen_epoch": "1566330782.874923" }, { "bytes": 144106, "stream": 138, "flow_id": "flow-2ac2dd4fa0c056e980b4c3ca", "packets": 613, "transport": "tcp", "last_frame": 16459, "first_frame": 15841, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49572, "responder_port": 445, "initiator_bytes": 85667, "last_seen_epoch": "1566330823.371644", "responder_bytes": 58439, "first_seen_epoch": "1566330793.110387" }, { "bytes": 53955, "stream": 139, "flow_id": "flow-2ea54783763f498e25e7faf1", "packets": 207, "transport": "tcp", "last_frame": 16672, "first_frame": 16460, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49573, "responder_port": 445, "initiator_bytes": 30684, "last_seen_epoch": "1566330828.599169", "responder_bytes": 23271, "first_seen_epoch": "1566330823.371705" }, { "bytes": 2682, "stream": 140, "flow_id": "flow-370867267c1821d36ab3da89", "packets": 20, "transport": "tcp", "last_frame": 16692, "first_frame": 16673, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49574, "responder_port": 445, "initiator_bytes": 1280, "last_seen_epoch": "1566330828.601963", "responder_bytes": 1402, "first_seen_epoch": "1566330828.599381" }, { "bytes": 887572, "stream": 141, "flow_id": "flow-2afd47c9933b9c056acee38e", "packets": 775, "transport": "tcp", "last_frame": 17504, "first_frame": 16693, "initiator_ip": "10.8.20.101", "responder_ip": "185.183.98.232", "initiator_port": 49575, "responder_port": 80, "initiator_bytes": 10261, "last_seen_epoch": "1566330895.022174", "responder_bytes": 877311, "first_seen_epoch": "1566330829.766801" }, { "bytes": 4917, "stream": 142, "flow_id": "flow-1d17068ae01cec54625205b3", "packets": 27, "transport": "tcp", "last_frame": 17510, "first_frame": 16694, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49576, "responder_port": 443, "initiator_bytes": 2280, "last_seen_epoch": "1566330907.846541", "responder_bytes": 2637, "first_seen_epoch": "1566330829.766912" }, { "bytes": 3345, "stream": 143, "flow_id": "flow-14ae0d27592914bf7a4a6384", "packets": 19, "transport": "tcp", "last_frame": 17599, "first_frame": 17511, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49577, "responder_port": 443, "initiator_bytes": 1105, "last_seen_epoch": "1566331024.910971", "responder_bytes": 2240, "first_seen_epoch": "1566330958.578283" }, { "bytes": 3193, "stream": 144, "flow_id": "flow-43a07dccaf7061f2b824d0f4", "packets": 19, "transport": "tcp", "last_frame": 17561, "first_frame": 17526, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49578, "responder_port": 443, "initiator_bytes": 1363, "last_seen_epoch": "1566331014.465829", "responder_bytes": 1830, "first_seen_epoch": "1566331000.043794" }, { "bytes": 3321, "stream": 145, "flow_id": "flow-74eae65b66cadebd39101020", "packets": 19, "transport": "tcp", "last_frame": 17580, "first_frame": 17541, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49579, "responder_port": 443, "initiator_bytes": 1411, "last_seen_epoch": "1566331016.614485", "responder_bytes": 1910, "first_seen_epoch": "1566331001.883452" }, { "bytes": 3776, "stream": 146, "flow_id": "flow-d8d81ef2abb74a63320f92ae", "packets": 22, "transport": "tcp", "last_frame": 17615, "first_frame": 17558, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49580, "responder_port": 443, "initiator_bytes": 1951, "last_seen_epoch": "1566331118.945621", "responder_bytes": 1825, "first_seen_epoch": "1566331014.239586" }, { "bytes": 3776, "stream": 147, "flow_id": "flow-351d0f631fac873f1db189f1", "packets": 22, "transport": "tcp", "last_frame": 17612, "first_frame": 17577, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49581, "responder_port": 443, "initiator_bytes": 1951, "last_seen_epoch": "1566331118.945121", "responder_bytes": 1825, "first_seen_epoch": "1566331016.308992" }, { "bytes": 11763, "stream": 148, "flow_id": "flow-d695dd37407aad7f5abe3070", "packets": 56, "transport": "tcp", "last_frame": 18358, "first_frame": 17645, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49582, "responder_port": 443, "initiator_bytes": 5652, "last_seen_epoch": "1566331331.342274", "responder_bytes": 6111, "first_seen_epoch": "1566331159.942337" }, { "bytes": 26772, "stream": 149, "flow_id": "flow-6ebaa5164b59be9ebb1aa153", "packets": 40, "transport": "tcp", "last_frame": 18278, "first_frame": 17657, "initiator_ip": "10.8.20.101", "responder_ip": "185.117.75.41", "initiator_port": 49583, "responder_port": 447, "initiator_bytes": 1327, "last_seen_epoch": "1566331228.353445", "responder_bytes": 25445, "first_seen_epoch": "1566331161.319743" }, { "bytes": 30535, "stream": 150, "flow_id": "flow-e7c4cee804120c9c276d413f", "packets": 121, "transport": "tcp", "last_frame": 18230, "first_frame": 17697, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49584, "responder_port": 3268, "initiator_bytes": 17881, "last_seen_epoch": "1566331164.822735", "responder_bytes": 12654, "first_seen_epoch": "1566331164.598962" }, { "bytes": 153128, "stream": 151, "flow_id": "flow-67eed3eec43df4c323de458e", "packets": 414, "transport": "tcp", "last_frame": 18233, "first_frame": 17814, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49585, "responder_port": 389, "initiator_bytes": 46237, "last_seen_epoch": "1566331165.02505", "responder_bytes": 106891, "first_seen_epoch": "1566331164.70422" }, { "bytes": 3276, "stream": 152, "flow_id": "flow-338f0a26753c3740148a6de4", "packets": 15, "transport": "tcp", "last_frame": 18327, "first_frame": 18232, "initiator_ip": "10.8.20.101", "responder_ip": "170.238.117.187", "initiator_port": 49586, "responder_port": 8082, "initiator_bytes": 2774, "last_seen_epoch": "1566331284.830924", "responder_bytes": 502, "first_seen_epoch": "1566331164.842389" }, { "bytes": 6265, "stream": 153, "flow_id": "flow-728f47de083e35406f8a5bdc", "packets": 22, "transport": "tcp", "last_frame": 18308, "first_frame": 18287, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 49587, "responder_port": 445, "initiator_bytes": 4567, "last_seen_epoch": "1566331266.55115", "responder_bytes": 1698, "first_seen_epoch": "1566331250.568505" }, { "bytes": 3364, "stream": 154, "flow_id": "flow-6edcc2b06cabc18ad1d2a368", "packets": 20, "transport": "tcp", "last_frame": 18370, "first_frame": 18328, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49588, "responder_port": 443, "initiator_bytes": 1481, "last_seen_epoch": "1566331421.901303", "responder_bytes": 1883, "first_seen_epoch": "1566331301.891816" }, { "bytes": 3748, "stream": 155, "flow_id": "flow-d6510b2e29ffaefbf6837542", "packets": 20, "transport": "tcp", "last_frame": 18367, "first_frame": 18343, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49589, "responder_port": 443, "initiator_bytes": 1977, "last_seen_epoch": "1566331421.900523", "responder_bytes": 1771, "first_seen_epoch": "1566331313.839137" }, { "bytes": 3345, "stream": 156, "flow_id": "flow-a1b62249ac37d888b5146cc5", "packets": 19, "transport": "tcp", "last_frame": 18393, "first_frame": 18371, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49590, "responder_port": 443, "initiator_bytes": 1105, "last_seen_epoch": "1566331537.618724", "responder_bytes": 2240, "first_seen_epoch": "1566331471.322758" }, { "bytes": 3138, "stream": 157, "flow_id": "flow-927461c5c6a605c3485d21bb", "packets": 17, "transport": "tcp", "last_frame": 18428, "first_frame": 18395, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49591, "responder_port": 443, "initiator_bytes": 1309, "last_seen_epoch": "1566331670.266191", "responder_bytes": 1829, "first_seen_epoch": "1566331601.895927" }, { "bytes": 3138, "stream": 158, "flow_id": "flow-8f6db0288ecc1585c93e1b8d", "packets": 17, "transport": "tcp", "last_frame": 18448, "first_frame": 18410, "initiator_ip": "10.8.20.101", "responder_ip": "185.193.141.166", "initiator_port": 49592, "responder_port": 443, "initiator_bytes": 1309, "last_seen_epoch": "1566331674.423538", "responder_bytes": 1829, "first_seen_epoch": "1566331605.261002" }, { "bytes": 7609, "stream": 159, "flow_id": "flow-b2e875b37a2927cf67437b4e", "packets": 36, "transport": "tcp", "last_frame": 18601, "first_frame": 18429, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49593, "responder_port": 443, "initiator_bytes": 3567, "last_seen_epoch": "1566331707.087807", "responder_bytes": 4042, "first_seen_epoch": "1566331672.903156" }, { "bytes": 44157, "stream": 160, "flow_id": "flow-95ad82c69c756da0c1031b0c", "packets": 54, "transport": "tcp", "last_frame": 18541, "first_frame": 18441, "initiator_ip": "10.8.20.101", "responder_ip": "185.117.75.41", "initiator_port": 49594, "responder_port": 447, "initiator_bytes": 1831, "last_seen_epoch": "1566331701.94571", "responder_bytes": 42326, "first_seen_epoch": "1566331674.255737" }, { "bytes": 6615, "stream": 161, "flow_id": "flow-0a5382f13841a0a2e0231376", "packets": 32, "transport": "tcp", "last_frame": 18646, "first_frame": 18477, "initiator_ip": "10.8.20.101", "responder_ip": "89.105.203.184", "initiator_port": 49595, "responder_port": 443, "initiator_bytes": 3166, "last_seen_epoch": "1566331707.920551", "responder_bytes": 3449, "first_seen_epoch": "1566331675.774302" }, { "bytes": 511, "stream": 162, "flow_id": "flow-ac9b7c44c86bc1bfc952ef71", "packets": 8, "transport": "tcp", "last_frame": 18520, "first_frame": 18491, "initiator_ip": "10.8.20.101", "responder_ip": "192.252.210.19", "initiator_port": 49596, "responder_port": 443, "initiator_bytes": 291, "last_seen_epoch": "1566331701.721003", "responder_bytes": 220, "first_seen_epoch": "1566331676.653621" }, { "bytes": 1411, "stream": 163, "flow_id": "flow-91e2ce378a7cad0e76d60667", "packets": 18, "transport": "tcp", "last_frame": 18940, "first_frame": 18546, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49597, "responder_port": 443, "initiator_bytes": 507, "last_seen_epoch": "1566331716.70762", "responder_bytes": 904, "first_seen_epoch": "1566331702.897389" }, { "bytes": 10030, "stream": 164, "flow_id": "flow-c5c5e32377fdec61d3cff059", "packets": 34, "transport": "tcp", "last_frame": 18686, "first_frame": 18559, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49598, "responder_port": 443, "initiator_bytes": 8027, "last_seen_epoch": "1566331709.410867", "responder_bytes": 2003, "first_seen_epoch": "1566331705.905321" }, { "bytes": 10031, "stream": 165, "flow_id": "flow-f1e77a8081c3d5886d509605", "packets": 34, "transport": "tcp", "last_frame": 18660, "first_frame": 18562, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49599, "responder_port": 443, "initiator_bytes": 8029, "last_seen_epoch": "1566331708.303596", "responder_bytes": 2002, "first_seen_epoch": "1566331705.93552" }, { "bytes": 174, "stream": 67, "flow_id": "flow-4a3704ef9c6fd70f87f778f4", "packets": 2, "transport": "udp", "last_frame": 18572, "first_frame": 18571, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 52178, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1566331706.356424", "responder_bytes": 95, "first_seen_epoch": "1566331706.334139" }, { "bytes": 9340, "stream": 166, "flow_id": "flow-d832a82d3d3ade32b64c4b36", "packets": 23, "transport": "tcp", "last_frame": 18656, "first_frame": 18573, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49601, "responder_port": 443, "initiator_bytes": 1606, "last_seen_epoch": "1566331708.303194", "responder_bytes": 7734, "first_seen_epoch": "1566331706.357985" }, { "bytes": 174, "stream": 68, "flow_id": "flow-a02b131b6cb4065ace457337", "packets": 2, "transport": "udp", "last_frame": 18606, "first_frame": 18605, "initiator_ip": "10.8.20.101", "responder_ip": "10.8.20.8", "initiator_port": 62235, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1566331707.347774", "responder_bytes": 95, "first_seen_epoch": "1566331707.347278" }, { "bytes": 9393, "stream": 167, "flow_id": "flow-3e65e0be1050ea8e7b64f6b4", "packets": 24, "transport": "tcp", "last_frame": 18682, "first_frame": 18607, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49600, "responder_port": 443, "initiator_bytes": 1661, "last_seen_epoch": "1566331709.410485", "responder_bytes": 7732, "first_seen_epoch": "1566331707.348266" }, { "bytes": 10705, "stream": 168, "flow_id": "flow-6f74a29cec5d6889afa9dd0a", "packets": 34, "transport": "tcp", "last_frame": 18798, "first_frame": 18688, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49602, "responder_port": 443, "initiator_bytes": 7837, "last_seen_epoch": "1566331714.386365", "responder_bytes": 2868, "first_seen_epoch": "1566331711.944597" }, { "bytes": 10701, "stream": 169, "flow_id": "flow-2d2e742ee41d703f032dddfc", "packets": 34, "transport": "tcp", "last_frame": 18814, "first_frame": 18694, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49603, "responder_port": 443, "initiator_bytes": 7832, "last_seen_epoch": "1566331714.630319", "responder_bytes": 2869, "first_seen_epoch": "1566331712.246626" }, { "bytes": 10068, "stream": 170, "flow_id": "flow-9bd91de9d00bf8a57ba2f649", "packets": 24, "transport": "tcp", "last_frame": 18794, "first_frame": 18696, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49604, "responder_port": 443, "initiator_bytes": 2526, "last_seen_epoch": "1566331714.386021", "responder_bytes": 7542, "first_seen_epoch": "1566331712.305608" }, { "bytes": 10064, "stream": 171, "flow_id": "flow-10d98c811a8c6d74a9d31a33", "packets": 24, "transport": "tcp", "last_frame": 18810, "first_frame": 18707, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49605, "responder_port": 443, "initiator_bytes": 2527, "last_seen_epoch": "1566331714.630044", "responder_bytes": 7537, "first_seen_epoch": "1566331712.607548" }, { "bytes": 9987, "stream": 172, "flow_id": "flow-624f84779f69fc1494808231", "packets": 30, "transport": "tcp", "last_frame": 18937, "first_frame": 18792, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49606, "responder_port": 443, "initiator_bytes": 7705, "last_seen_epoch": "1566331716.596863", "responder_bytes": 2282, "first_seen_epoch": "1566331714.351632" }, { "bytes": 9879, "stream": 173, "flow_id": "flow-7de056c8faef671ade43b094", "packets": 28, "transport": "tcp", "last_frame": 18935, "first_frame": 18808, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49607, "responder_port": 443, "initiator_bytes": 7651, "last_seen_epoch": "1566331716.50362", "responder_bytes": 2228, "first_seen_epoch": "1566331714.616324" }, { "bytes": 9589, "stream": 174, "flow_id": "flow-8bc20704e505150d4edfa0bf", "packets": 24, "transport": "tcp", "last_frame": 18943, "first_frame": 18817, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49608, "responder_port": 443, "initiator_bytes": 2048, "last_seen_epoch": "1566331716.733467", "responder_bytes": 7541, "first_seen_epoch": "1566331714.71942" }, { "bytes": 9296, "stream": 175, "flow_id": "flow-80896146835da8c4035f1b47", "packets": 19, "transport": "tcp", "last_frame": 18931, "first_frame": 18827, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49609, "responder_port": 443, "initiator_bytes": 1886, "last_seen_epoch": "1566331716.503256", "responder_bytes": 7410, "first_seen_epoch": "1566331714.981079" }, { "bytes": 6152, "stream": 176, "flow_id": "flow-4693fcbf8a2f4107c5a8513f", "packets": 18, "transport": "tcp", "last_frame": 18928, "first_frame": 18869, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49610, "responder_port": 443, "initiator_bytes": 5263, "last_seen_epoch": "1566331716.473476", "responder_bytes": 889, "first_seen_epoch": "1566331715.581349" }, { "bytes": 5623, "stream": 177, "flow_id": "flow-7415ff534d583506ad0c4904", "packets": 10, "transport": "tcp", "last_frame": 18920, "first_frame": 18886, "initiator_ip": "10.8.20.101", "responder_ip": "185.70.40.151", "initiator_port": 49611, "responder_port": 443, "initiator_bytes": 601, "last_seen_epoch": "1566331716.473137", "responder_bytes": 5022, "first_seen_epoch": "1566331715.949999" }, { "bytes": 66, "stream": 178, "flow_id": "flow-a57af847696f72782882482c", "packets": 1, "transport": "tcp", "last_frame": 18941, "first_frame": 18941, "initiator_ip": "10.8.20.101", "responder_ip": "5.39.113.142", "initiator_port": 49612, "responder_port": 443, "initiator_bytes": 66, "last_seen_epoch": "1566331716.7082", "responder_bytes": 0, "first_seen_epoch": "1566331716.7082" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-e4e326de8146bedde06dfacb", "src_port": 57565, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1566329449.877162000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 57565, "event_id": "evt-5d03189e87d206040a2f80f2", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1566329449.877379000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-eacffb2f5c21763638bccfc3", "src_port": 61835, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1566329449.878429000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 61835, "event_id": "evt-3317b21cae643a42421ebfbe", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1566329449.878593000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "badbundt-dc.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-a4a9d90ac9baf772b7129bbb", "src_port": 50268, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1566329449.880862000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "badbundt-dc.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-682b2ab086c87b454ac82987", "src_port": 55549, "tcp_stream": null, "udp_stream": 4, "frame_number": 8, "timestamp_epoch": "1566329449.881049000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "badbundt-dc.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 50268, "event_id": "evt-b4f39f6097d0d85b55953655", "src_port": 53, "tcp_stream": null, "udp_stream": 3, "frame_number": 9, "timestamp_epoch": "1566329449.881124000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "badbundt-dc.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 55549, "event_id": "evt-37c9abf8865ac624a755c59f", "src_port": 53, "tcp_stream": null, "udp_stream": 4, "frame_number": 10, "timestamp_epoch": "1566329449.881216000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-b9c4406459c98b771cab5f4f", "src_port": 64793, "tcp_stream": null, "udp_stream": 8, "frame_number": 60, "timestamp_epoch": "1566329450.068573000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 64793, "event_id": "evt-c81de83f157cacdf70f9a57d", "src_port": 53, "tcp_stream": null, "udp_stream": 8, "frame_number": 63, "timestamp_epoch": "1566329450.068849000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-3a708096ccd881fc46e5959b", "src_port": 50892, "tcp_stream": null, "udp_stream": 10, "frame_number": 99, "timestamp_epoch": "1566329450.078946000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 50892, "event_id": "evt-eaa3a608c376ad2c141563dd", "src_port": 53, "tcp_stream": null, "udp_stream": 10, "frame_number": 101, "timestamp_epoch": "1566329450.079103000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-e84f4abeaf6f1256a6820d1e", "src_port": 64669, "tcp_stream": null, "udp_stream": 12, "frame_number": 180, "timestamp_epoch": "1566329450.184474000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 64669, "event_id": "evt-9b68eb696431898cbca07dfe", "src_port": 53, "tcp_stream": null, "udp_stream": 12, "frame_number": 181, "timestamp_epoch": "1566329450.184657000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-eb4d7674c7d0ab17d5d802c9", "src_port": 59257, "tcp_stream": null, "udp_stream": 14, "frame_number": 261, "timestamp_epoch": "1566329451.120117000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 59257, "event_id": "evt-a8bb12f87a9a8061229672c2", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 262, "timestamp_epoch": "1566329451.120527000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-a90fbeab58efef98e2ba5b60", "src_port": 58125, "tcp_stream": null, "udp_stream": 15, "frame_number": 263, "timestamp_epoch": "1566329451.121080000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "_ldap._tcp.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 58125, "event_id": "evt-53b44f0bb2a79a9d02b3fbf2", "src_port": 53, "tcp_stream": null, "udp_stream": 15, "frame_number": 264, "timestamp_epoch": "1566329451.121263000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "wpad.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-f2691a23a1bda9566f8957c7", "src_port": 52212, "tcp_stream": null, "udp_stream": 17, "frame_number": 382, "timestamp_epoch": "1566329453.107072000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "wpad.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 52212, "event_id": "evt-b1ba8351ce0997cf0b5c3390", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 383, "timestamp_epoch": "1566329453.107285000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "BadBundt-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-9a88747ea1a5a41d8312523c", "src_port": 63819, "tcp_stream": null, "udp_stream": 19, "frame_number": 389, "timestamp_epoch": "1566329453.214843000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "BadBundt-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 63819, "event_id": "evt-9738fe9bc7b633545fb82373", "src_port": 53, "tcp_stream": null, "udp_stream": 19, "frame_number": 390, "timestamp_epoch": "1566329453.215159000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "isatap.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-29ed07a6d598a437753154d4", "src_port": 54972, "tcp_stream": null, "udp_stream": 20, "frame_number": 391, "timestamp_epoch": "1566329453.229001000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "isatap.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 54972, "event_id": "evt-ed82ea9e6bf75072577b8149", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 392, "timestamp_epoch": "1566329453.229263000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-8c0d13cf769022f4fcb95229", "src_port": 61765, "tcp_stream": null, "udp_stream": 21, "frame_number": 393, "timestamp_epoch": "1566329453.374157000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "isatap.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 61765, "event_id": "evt-c22301ccb98ef9626a2f41b2", "src_port": 53, "tcp_stream": null, "udp_stream": 21, "frame_number": 394, "timestamp_epoch": "1566329453.374403000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "BadBundt-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-e8cfec86935c320001fdf6a9", "src_port": 54358, "tcp_stream": null, "udp_stream": 23, "frame_number": 403, "timestamp_epoch": "1566329454.713695000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "BadBundt-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 54358, "event_id": "evt-b2745ea07aa85f5bf40caf8e", "src_port": 53, "tcp_stream": null, "udp_stream": 23, "frame_number": 404, "timestamp_epoch": "1566329454.714016000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-608a24cdb190979257411312", "src_port": 54351, "tcp_stream": null, "udp_stream": 25, "frame_number": 408, "timestamp_epoch": "1566329455.680831000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "63.239.233.90,63.239.233.84,63.239.233.75,63.239.233.92,63.239.233.91,63.239.233.82,63.239.233.83,63.239.233.76,63.239.233.68", "dns.cname": "www.msftncsi.com.edgesuite.net,a1961.g2.akamai.net", "dns.qry.name": "www.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 54351, "event_id": "evt-97f662b089356328c49014d8", "src_port": 53, "tcp_stream": null, "udp_stream": 25, "frame_number": 409, "timestamp_epoch": "1566329455.710994000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "Tampa-Office-PC.badbundt.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-4904af776fcd666dcd9cae3c", "src_port": 57797, "tcp_stream": null, "udp_stream": 26, "frame_number": 419, "timestamp_epoch": "1566329458.111159000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "Tampa-Office-PC.badbundt.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 57797, "event_id": "evt-088e867baee705eb7500f1a8", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 420, "timestamp_epoch": "1566329458.111494000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.a": "10.8.20.101", "dns.qry.name": "badbundt.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-81935cea174298b10a9bba10", "src_port": 64095, "tcp_stream": null, "udp_stream": 27, "frame_number": 421, "timestamp_epoch": "1566329458.112209000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.101", "dns.qry.name": "badbundt.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 64095, "event_id": "evt-3f1ecc7e65f5dff827f0b3d3", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 422, "timestamp_epoch": "1566329458.112974000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-3f0a66d0ba960c8f47b6abdf", "src_port": 55748, "tcp_stream": null, "udp_stream": 28, "frame_number": 590, "timestamp_epoch": "1566329464.943297000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 55748, "event_id": "evt-5d6c84fbc8f75f1356f6b5df", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 591, "timestamp_epoch": "1566329464.943530000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-237dd57571dd7b27255ae7bd", "src_port": 52196, "tcp_stream": null, "udp_stream": 29, "frame_number": 592, "timestamp_epoch": "1566329464.945404000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "_ldap._tcp.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 52196, "event_id": "evt-1f64aac0f4f4fcf90e42b760", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 593, "timestamp_epoch": "1566329464.945543000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-ebb546ec9898ed2e62abb934", "src_port": 51822, "tcp_stream": null, "udp_stream": 30, "frame_number": 650, "timestamp_epoch": "1566329465.460030000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 51822, "event_id": "evt-dfd700be99d4ed4a615ca74f", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 655, "timestamp_epoch": "1566329465.486337000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "bh79sbu.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-52fe1679bb40d88b140113a5", "src_port": 51179, "tcp_stream": null, "udp_stream": 31, "frame_number": 682, "timestamp_epoch": "1566329493.324340000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "94.103.87.160", "dns.qry.name": "bh79sbu.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 51179, "event_id": "evt-cd05fcddea8c49820972effa", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 683, "timestamp_epoch": "1566329493.560314000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "wpad.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-55bc7dbb252ad24d49b3b013", "src_port": 62399, "tcp_stream": null, "udp_stream": 33, "frame_number": 1317, "timestamp_epoch": "1566329681.344278000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "wpad.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 62399, "event_id": "evt-74a129738909999eafd0db25", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 1318, "timestamp_epoch": "1566329681.344602000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-4590e72db2336871ec1ff2dc", "src_port": 65381, "tcp_stream": null, "udp_stream": 34, "frame_number": 1319, "timestamp_epoch": "1566329681.344864000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 65381, "event_id": "evt-fc6d9ae0d2f1ee3fe2df5f3c", "src_port": 53, "tcp_stream": null, "udp_stream": 34, "frame_number": 1320, "timestamp_epoch": "1566329681.345121000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-12a53feb45168321c965016d", "src_port": 64967, "tcp_stream": null, "udp_stream": 36, "frame_number": 1322, "timestamp_epoch": "1566329681.389915000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "172.217.6.174", "dns.qry.name": "google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 64967, "event_id": "evt-de2e78053c1f9f2de2bee90c", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 1324, "timestamp_epoch": "1566329681.506167000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-ddefe32b6be99848171bb260", "src_port": 55481, "tcp_stream": null, "udp_stream": 37, "frame_number": 1336, "timestamp_epoch": "1566329681.632531000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "172.217.9.132", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 55481, "event_id": "evt-f3698aa899e34446b562c91a", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 1338, "timestamp_epoch": "1566329681.649446000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "gmail.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-f4424ce1741af613a5cba098", "src_port": 54444, "tcp_stream": null, "udp_stream": 38, "frame_number": 1367, "timestamp_epoch": "1566329702.684441000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "172.217.6.133", "dns.qry.name": "gmail.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 54444, "event_id": "evt-75e6a9efc6cb43a70ea4cef5", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 1368, "timestamp_epoch": "1566329702.707409000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "hne53brianaea.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-f97811d03132f76bd986c23c", "src_port": 60473, "tcp_stream": null, "udp_stream": 39, "frame_number": 1444, "timestamp_epoch": "1566329723.938616000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "94.103.86.146", "dns.qry.name": "hne53brianaea.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 60473, "event_id": "evt-0bfdde712f776f111abbf083", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 1445, "timestamp_epoch": "1566329723.982026000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-ed6a38f749153375c675727b", "src_port": 59481, "tcp_stream": null, "udp_stream": 40, "frame_number": 1963, "timestamp_epoch": "1566329796.056738000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "208.67.222.222", "dns.qry.name": "resolver1.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 59481, "event_id": "evt-2464f064d3e2f0a0a5ecac2c", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 1964, "timestamp_epoch": "1566329796.089726000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-badf39c4f9dbbc7df12a7086", "src_port": 59482, "tcp_stream": null, "udp_stream": 41, "frame_number": 1965, "timestamp_epoch": "1566329796.096059000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "222.222.67.208.in-addr.arpa", "dns.qry.type": "12", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 59482, "event_id": "evt-f741d16c36bd86e212c4c828", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 1966, "timestamp_epoch": "1566329796.110202000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-6752150829793885678c8e40", "src_port": 59483, "tcp_stream": null, "udp_stream": 42, "frame_number": 1967, "timestamp_epoch": "1566329796.110953000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "myip.opendns.com.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 59483, "event_id": "evt-6a71477452a94307d7aaa299", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 1968, "timestamp_epoch": "1566329796.162199000" }, { "kind": "dns", "dst_ip": "208.67.222.222", "fields": { "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-ffe65ac444c32c8f4a7a76fa", "src_port": 59485, "tcp_stream": null, "udp_stream": 43, "frame_number": 1969, "timestamp_epoch": "1566329796.285649000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "173.166.146.112", "dns.qry.name": "myip.opendns.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "208.67.222.222", "dst_port": 59485, "event_id": "evt-7d94faaebefe424c660f9372", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 1970, "timestamp_epoch": "1566329796.306864000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "kjoanaxbrennan.top", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-634b301425402ff4c1cc472f", "src_port": 52157, "tcp_stream": null, "udp_stream": 44, "frame_number": 2011, "timestamp_epoch": "1566329806.704700000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "185.193.141.166", "dns.qry.name": "kjoanaxbrennan.top", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 52157, "event_id": "evt-bf62c6bc50835bfbd8c783ce", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 2012, "timestamp_epoch": "1566329806.728922000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-c72559f1898923b7a520cef4", "src_port": 55183, "tcp_stream": null, "udp_stream": 45, "frame_number": 2024, "timestamp_epoch": "1566329807.511295000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "23.200.143.72,23.200.143.27,23.200.143.50,23.200.143.35,23.200.143.41,23.200.143.74,23.200.143.56,23.200.143.57,23.200.143.43", "dns.cname": "2-01-3cf7-0009.cdx.cedexis.net,download.windowsupdate.com.edgesuite.net,a767.dspw65.akamai.net", "dns.qry.name": "www.download.windowsupdate.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 55183, "event_id": "evt-c4d24330da70b3fa25b417d2", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 2025, "timestamp_epoch": "1566329807.574008000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "activity.qingcloud.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-39334039232ae7099be4f073", "src_port": 58097, "tcp_stream": null, "udp_stream": 46, "frame_number": 2133, "timestamp_epoch": "1566330098.980354000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "139.198.5.65", "dns.qry.name": "activity.qingcloud.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 58097, "event_id": "evt-c7e6716ae9dcdbd8fef5b33f", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 2134, "timestamp_epoch": "1566330099.301598000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "api.ip.sb", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-ce690da2d75bf3d811e5e532", "src_port": 52316, "tcp_stream": null, "udp_stream": 47, "frame_number": 3000, "timestamp_epoch": "1566330133.296128000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "185.248.87.88", "dns.qry.name": "api.ip.sb", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 52316, "event_id": "evt-edbf24a4856c8ec5addccc81", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 3001, "timestamp_epoch": "1566330133.355663000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "112.146.166.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-af6204ceadebe6607a0d4d82", "src_port": 61169, "tcp_stream": null, "udp_stream": 48, "frame_number": 3067, "timestamp_epoch": "1566330147.304370000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "112.146.166.173.zen.spamhaus.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 61169, "event_id": "evt-2315374a0bb1dd973ba8f630", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 3068, "timestamp_epoch": "1566330147.374893000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "112.146.166.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-f1dab719205c19a57d791058", "src_port": 53363, "tcp_stream": null, "udp_stream": 49, "frame_number": 3069, "timestamp_epoch": "1566330147.376289000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "112.146.166.173.cbl.abuseat.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 53363, "event_id": "evt-8a5636ae04cf8648989c598b", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 3071, "timestamp_epoch": "1566330147.443688000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "112.146.166.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-8a41117e78d0c1530334ac13", "src_port": 60142, "tcp_stream": null, "udp_stream": 50, "frame_number": 3072, "timestamp_epoch": "1566330147.444500000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "112.146.166.173.b.barracudacentral.org", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 60142, "event_id": "evt-823383df8217604b8e2e26b0", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 3073, "timestamp_epoch": "1566330147.516641000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "112.146.166.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-4a675d8de8fa5b20f73a78f2", "src_port": 57426, "tcp_stream": null, "udp_stream": 51, "frame_number": 3074, "timestamp_epoch": "1566330147.518389000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "112.146.166.173.dnsbl-1.uceprotect.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 57426, "event_id": "evt-d4a28954b8140a601c2710c8", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 3075, "timestamp_epoch": "1566330147.580034000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "112.146.166.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-3c42d30bd988fb488451ec5d", "src_port": 63954, "tcp_stream": null, "udp_stream": 52, "frame_number": 3076, "timestamp_epoch": "1566330147.581274000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "112.146.166.173.spam.dnsbl.sorbs.net", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 63954, "event_id": "evt-fb0496647e6a44ddd7759f7f", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 3077, "timestamp_epoch": "1566330147.609808000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "idogoiania.com.br", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-9aff83245f02caf46ea79217", "src_port": 50516, "tcp_stream": null, "udp_stream": 53, "frame_number": 3246, "timestamp_epoch": "1566330403.320857000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "206.189.74.47", "dns.qry.name": "idogoiania.com.br", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 50516, "event_id": "evt-9ba3c0903cac65968d847d56", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 3247, "timestamp_epoch": "1566330403.344480000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-1dfb91a1bfbce4f6b475e09c", "src_port": 60600, "tcp_stream": null, "udp_stream": 57, "frame_number": 8996, "timestamp_epoch": "1566330632.497390000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 60600, "event_id": "evt-823c4ad2b9648c50b28e5e3d", "src_port": 53, "tcp_stream": null, "udp_stream": 57, "frame_number": 8997, "timestamp_epoch": "1566330632.497685000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-e46c0e17bfb101c69b828861", "src_port": 63404, "tcp_stream": null, "udp_stream": 59, "frame_number": 9219, "timestamp_epoch": "1566330632.699346000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 63404, "event_id": "evt-9c907e35e13c9b02c9592d9a", "src_port": 53, "tcp_stream": null, "udp_stream": 59, "frame_number": 9220, "timestamp_epoch": "1566330632.699591000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "_ldap._tcp.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-5d7913de13c1a9a49c4e4829", "src_port": 53590, "tcp_stream": null, "udp_stream": 60, "frame_number": 9221, "timestamp_epoch": "1566330632.699879000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "_ldap._tcp.BadBundt-DC.badbundt.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 53590, "event_id": "evt-3a7083c46805fcadfe839355", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 9222, "timestamp_epoch": "1566330632.700045000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "wpad.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-42dc851dee21e8a74caa8968", "src_port": 63468, "tcp_stream": null, "udp_stream": 61, "frame_number": 9398, "timestamp_epoch": "1566330632.760456000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "wpad.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 63468, "event_id": "evt-8ba09dc4e46cb5d040b81c5b", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 9399, "timestamp_epoch": "1566330632.760705000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-a09e997a71e525057be82b10", "src_port": 50092, "tcp_stream": null, "udp_stream": 62, "frame_number": 9400, "timestamp_epoch": "1566330632.761022000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 50092, "event_id": "evt-1dc84bd5f2841a08f33a2676", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 9401, "timestamp_epoch": "1566330632.778985000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "BadBundt-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-8206397b93232de47adedd8a", "src_port": 61223, "tcp_stream": null, "udp_stream": 64, "frame_number": 10005, "timestamp_epoch": "1566330654.941768000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "BadBundt-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 61223, "event_id": "evt-1be1a3f8259ff3d37d8c386f", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 10006, "timestamp_epoch": "1566330654.942042000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "BADBUNDT-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-a677c3a22ae6156aa3885640", "src_port": 58727, "tcp_stream": null, "udp_stream": 65, "frame_number": 10026, "timestamp_epoch": "1566330654.977069000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "10.8.20.8", "dns.qry.name": "BADBUNDT-DC.badbundt.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 58727, "event_id": "evt-aaff869485b77bff4c87f877", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 10027, "timestamp_epoch": "1566330654.977320000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "boozzdigital.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-7000afb63a4cfc8d9043bb8b", "src_port": 51984, "tcp_stream": null, "udp_stream": 66, "frame_number": 12664, "timestamp_epoch": "1566330702.438541000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "68.183.185.221", "dns.qry.name": "boozzdigital.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 51984, "event_id": "evt-9c9d073753cb50fe8cc04724", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 12665, "timestamp_epoch": "1566330702.513714000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "mail.protonmail.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-b5589f14eaca72f1b18dada2", "src_port": 52178, "tcp_stream": null, "udp_stream": 67, "frame_number": 18571, "timestamp_epoch": "1566331706.334139000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "185.70.40.151", "dns.qry.name": "mail.protonmail.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 52178, "event_id": "evt-a6ac293581e7b53ec342e23a", "src_port": 53, "tcp_stream": null, "udp_stream": 67, "frame_number": 18572, "timestamp_epoch": "1566331706.356424000" }, { "kind": "dns", "dst_ip": "10.8.20.8", "fields": { "dns.qry.name": "mail.protonmail.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": 53, "event_id": "evt-15069a07580cbc306d083cee", "src_port": 62235, "tcp_stream": null, "udp_stream": 68, "frame_number": 18605, "timestamp_epoch": "1566331707.347278000" }, { "kind": "dns", "dst_ip": "10.8.20.101", "fields": { "dns.a": "185.70.40.151", "dns.qry.name": "mail.protonmail.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.8.20.8", "dst_port": 62235, "event_id": "evt-1cdf8e67b250be2519f94e5a", "src_port": 53, "tcp_stream": null, "udp_stream": 68, "frame_number": 18606, "timestamp_epoch": "1566331707.347774000" } ], "dhcp": [], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<00>,TAMPA-OFFICE-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-792a75aa782d1fade20ca813", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1566329449.865545000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<00>,BADBUNDT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-79bf2e9a6e67c4e63ca0de1c", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1566329449.865877000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "Tampa-Office-PC" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0f6fe887f5d29cd36614456c", "src_port": null, "tcp_stream": null, "udp_stream": 7, "frame_number": 17, "timestamp_epoch": "1566329449.920576000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "Tampa-Office-PC" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4fe93caed23ef4e2d0bbcfef", "src_port": null, "tcp_stream": null, "udp_stream": 7, "frame_number": 25, "timestamp_epoch": "1566329450.020836000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "tampa-office-pc$" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4bf0e07ba5e363be6488db8f", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 51, "timestamp_epoch": "1566329450.046833000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f6e4c6a14215429175298fb5", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 52, "timestamp_epoch": "1566329450.048143000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "tampa-office-pc$" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7b7d90c39f877f498e3a180b", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 59, "timestamp_epoch": "1566329450.067873000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-66db5d25a5344d77cda9912e", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 62, "timestamp_epoch": "1566329450.068683000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4b1a55c7aa91f4aca4f35900", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 74, "timestamp_epoch": "1566329450.072850000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5fce9a60acab0f298a11d00a", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 77, "timestamp_epoch": "1566329450.074033000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ae4208c8557dd7ad9087baca", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 84, "timestamp_epoch": "1566329450.075055000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-44afda1b1a0c8feaaf798b9f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1566329450.075893000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-aa0fe908877989992d1667a1", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 90, "timestamp_epoch": "1566329450.076116000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-60de269e4f4e39df158b47a0", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 94, "timestamp_epoch": "1566329450.077826000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-27fb9cf478aef6cf66a32390", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 96, "timestamp_epoch": "1566329450.078073000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "tampa-office-pc$" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-154ed517272e1e2ee5d86859", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 102, "timestamp_epoch": "1566329450.079112000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-068c3c28287a38cbff5c27fb", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 103, "timestamp_epoch": "1566329450.079453000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "tampa-office-pc$" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-81cb616bb51d4fe5bebbc08c", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 113, "timestamp_epoch": "1566329450.100891000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a36172cd2454fcde2773b639", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 115, "timestamp_epoch": "1566329450.101818000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f868536dc35bc9eb747a5aa7", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 124, "timestamp_epoch": "1566329450.104885000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-791f2eb7030d9c02e85ff8c6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 127, "timestamp_epoch": "1566329450.106023000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d2dabdfbb50a759eed4eb8b7", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1566329450.106906000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2eb96de61298641835a90df4", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1566329450.107229000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b0f989b9a33d68d2c3ecd387", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 142, "timestamp_epoch": "1566329450.108120000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8d4d6c62001c22748b1aeb48", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 144, "timestamp_epoch": "1566329450.108811000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-00cd13dbf4ea1da474e98411", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 145, "timestamp_epoch": "1566329450.110279000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6dc7813ae862d77ff439942c", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1566329450.110554000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a5f9851e4805803e9aba97c4", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 147, "timestamp_epoch": "1566329450.111595000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6cc453848657e907b992690d", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 148, "timestamp_epoch": "1566329450.111985000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-55f6abf98511d909a58b0dd1", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 160, "timestamp_epoch": "1566329450.180631000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7084feed6c4b40a1a57e1d1a", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1566329450.181431000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4f9b35b7c8c6aad5329c2079", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1566329450.182377000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0a89c1246f24d87b59295883", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 174, "timestamp_epoch": "1566329450.182993000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<20>,TAMPA-OFFICE-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ce85d33716bc929a26b695e8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 188, "timestamp_epoch": "1566329450.202042000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b68f9d04203705cef9ee66ee", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 222, "timestamp_epoch": "1566329450.527556000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d14c8e171a3b117afd1f6aa3", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 223, "timestamp_epoch": "1566329450.527962000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-047ff47bee651addb6d04c1b", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 233, "timestamp_epoch": "1566329450.539697000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-46b21770a5771e35e1ec6417", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 236, "timestamp_epoch": "1566329450.540914000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6f82adbdabf3208ae4021622", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 242, "timestamp_epoch": "1566329450.543072000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-167e0559e69330c0ac629a01", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 244, "timestamp_epoch": "1566329450.543648000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d2e783deea81751edecb11d8", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1566329450.543930000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<00>,BADBUNDT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ad7f51172ef7ec97dfe8a64b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 255, "timestamp_epoch": "1566329450.616091000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<00>,TAMPA-OFFICE-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8b64663d7d82f6f2b7b15ecd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 256, "timestamp_epoch": "1566329450.616241000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<20>,TAMPA-OFFICE-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2f51c7c4585cf76e3cd6ff34", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 260, "timestamp_epoch": "1566329450.956222000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-521a045e43eb6a56cd75f523", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1566329451.125010000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ddee3390091e4cdea32ac3b2", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 275, "timestamp_epoch": "1566329451.125804000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-13cf1f7a689dcd0558039f92", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 280, "timestamp_epoch": "1566329451.132424000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-812001323e569a07f3875886", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 283, "timestamp_epoch": "1566329451.133410000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9edf66342e699b509b3631f2", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 292, "timestamp_epoch": "1566329451.136617000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5e1776073d344be20a695de0", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 295, "timestamp_epoch": "1566329451.137858000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-15fc39688c171e571a584fd6", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 306, "timestamp_epoch": "1566329451.138901000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fac40ad2cea5147ffcd72451", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 309, "timestamp_epoch": "1566329451.139467000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b5e1560cf15ecf0ebd9c0d40", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 314, "timestamp_epoch": "1566329451.139965000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ad62572799cc344d12e418d0", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1566329451.140475000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-36d65e18b8fcbb2dcb23b239", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 326, "timestamp_epoch": "1566329451.144969000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6156ba78f6c01eb9d71e983f", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 327, "timestamp_epoch": "1566329451.145305000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4760b7f88327870770c476bd", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 332, "timestamp_epoch": "1566329451.146349000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0b9c39e806694c04b635cb20", "src_port": null, "tcp_stream": 25, "udp_stream": null, "frame_number": 335, "timestamp_epoch": "1566329451.147264000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c105b489f28be1f6afeff746", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 343, "timestamp_epoch": "1566329451.148025000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-31a61b31a671834649202426", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 344, "timestamp_epoch": "1566329451.148554000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-df0660d71a75e1be2e8fbe3c", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 351, "timestamp_epoch": "1566329451.149311000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ce928f29af7476034eede6dd", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 352, "timestamp_epoch": "1566329451.149953000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-42c224c3abf0f133fc2f4915", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1566329451.150355000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-625497e2eb9318738dd49447", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 354, "timestamp_epoch": "1566329451.150482000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4d9efc737f02da677926247c", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1566329451.150764000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e053ba83293d7aebff5145e7", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 356, "timestamp_epoch": "1566329451.150977000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-23d61343105070b8bd219766", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1566329451.151271000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1ed9b4bf00e0e6c7c860ee20", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1566329451.151484000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d07eaf541d425d95252ff878", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1566329451.151753000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-99ce68127233272edb143da1", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1566329451.151856000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-32c0d29e6563eae1295b9112", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1566329451.152247000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-02a7f75922c5e258867c4d37", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1566329451.152508000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f567d114e7cc30415a5f9083", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1566329451.152790000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-96176c414f0f51fa0052b8b5", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1566329451.152913000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<00>,TAMPA-OFFICE-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d6afe30ef2195f6f0568f720", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 369, "timestamp_epoch": "1566329451.367214000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<00>,BADBUNDT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-34638ce8cf360008de433088", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 370, "timestamp_epoch": "1566329451.367358000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<20>,TAMPA-OFFICE-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-be8bc9acc2809219db319845", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 375, "timestamp_epoch": "1566329451.705838000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<00>,BADBUNDT<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-df9f67b455b9016a92f11e34", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 376, "timestamp_epoch": "1566329452.116487000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<00>,TAMPA-OFFICE-PC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-841d20441699f6458d06adae", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 377, "timestamp_epoch": "1566329452.116713000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "TAMPA-OFFICE-PC<20>,TAMPA-OFFICE-PC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-878c69c1b5d73a2d53dab0ca", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 378, "timestamp_epoch": "1566329452.455823000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "Tampa-Office-PC" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1a63dbcae15794625f16f500", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 381, "timestamp_epoch": "1566329453.099275000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "wpad" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d99b9e2a40dd4f41c8b78f0e", "src_port": null, "tcp_stream": null, "udp_stream": 18, "frame_number": 384, "timestamp_epoch": "1566329453.107937000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "Tampa-Office-PC" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3d8d8d1278b1967a27a1c82a", "src_port": null, "tcp_stream": null, "udp_stream": 16, "frame_number": 385, "timestamp_epoch": "1566329453.196570000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "wpad" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3d450416c8ebe84cdeb42a5f", "src_port": null, "tcp_stream": null, "udp_stream": 18, "frame_number": 386, "timestamp_epoch": "1566329453.207511000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7eb3d76875380fdcad8bbe26", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 387, "timestamp_epoch": "1566329453.208899000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2e8623a90ff6840c07126564", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 388, "timestamp_epoch": "1566329453.209235000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "Tampa-Office-PC" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4a7f2de89db3489c82f44a2e", "src_port": null, "tcp_stream": null, "udp_stream": 22, "frame_number": 397, "timestamp_epoch": "1566329453.397402000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-72a91829e8187d67a0e39f45", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 399, "timestamp_epoch": "1566329453.407033000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "Tampa-Office-PC" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-033bed1bd3a6825a28eb919e", "src_port": null, "tcp_stream": null, "udp_stream": 22, "frame_number": 400, "timestamp_epoch": "1566329453.496826000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-be6b115475eb4c320aaface1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 402, "timestamp_epoch": "1566329454.156209000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-72bc29a8415175ac59e6fd79", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 407, "timestamp_epoch": "1566329454.912590000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3446010e19be804c6a82c61d", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1566329460.823517000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bf1b71e2bcebed589e7e4070", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1566329460.824114000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9e52a0018e4fc0c2d3c0662a", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1566329460.835897000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2aa14d94da9a988119bc5d55", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1566329460.836498000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1095bb940f5bf6c279ee0e34", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 454, "timestamp_epoch": "1566329460.838113000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4033dcbd359eeeda8dc86c7c", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1566329460.839250000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8826599527bc0d2721c91475", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 462, "timestamp_epoch": "1566329460.855376000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-58ee7d2f9d6d3ab2eecc0862", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1566329460.856333000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c93cfcae1fe6701554569eb2", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1566329460.857592000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "TAMPA-OFFICE-PC$" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e7adb3a68a62c98666fa87be", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 476, "timestamp_epoch": "1566329460.858271000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d50d764e7924c987ed9bb0d7", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 490, "timestamp_epoch": "1566329464.349898000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5dd120de2339b870f6aa1e15", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 491, "timestamp_epoch": "1566329464.351197000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "10", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-364ce62f342c26eba08dec84", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1566329464.373469000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-01a18ecacbb530cb9ab079db", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 500, "timestamp_epoch": "1566329464.374659000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a057092ee85cf6e820ecf718", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 509, "timestamp_epoch": "1566329464.375729000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8bddcf4ae430c1f2cc72dddb", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 512, "timestamp_epoch": "1566329464.376545000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5abfa6ae6fe4fb5cb22a6db7", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 523, "timestamp_epoch": "1566329464.416414000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-30393f788f253d2bdcc82e40", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 526, "timestamp_epoch": "1566329464.417621000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c70b013afc58df617f98033c", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 532, "timestamp_epoch": "1566329464.418356000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4c0d8458e675ecd0a17ef35d", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 534, "timestamp_epoch": "1566329464.419232000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b22ca8f476a067d4c4abaf9a", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 535, "timestamp_epoch": "1566329464.419670000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1ee403375c5932755b84aacd", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 549, "timestamp_epoch": "1566329464.452725000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d76dfe4f3be6b7512ba80345", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 550, "timestamp_epoch": "1566329464.454396000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9eef7d79747eb9cb201d1a83", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 551, "timestamp_epoch": "1566329464.454628000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-44759cb62cae12b4402e3d94", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 556, "timestamp_epoch": "1566329464.457342000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3291acec762793e0446ca53b", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 559, "timestamp_epoch": "1566329464.458208000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c28027ed3bb0e38ca3056338", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 568, "timestamp_epoch": "1566329464.459408000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c7c31e9c1d9aad3a6998c016", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 571, "timestamp_epoch": "1566329464.459752000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e743bfb1aab641255bd4e5de", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1566329464.460479000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-20604a48264718c89b4ea822", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1566329464.461027000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-347c0f8e8d9987745eeb2e51", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 581, "timestamp_epoch": "1566329464.461442000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5fdb652f7eaa22aa286a1523", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 582, "timestamp_epoch": "1566329464.461588000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-31046e527f0fe69b4b3aa041", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 583, "timestamp_epoch": "1566329464.461868000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f37517daaf385a0b24637f4d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1566329464.571062000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9eb98eb331387a129cdb3a2d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1566329464.576837000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e4b89cdaf33a67974effff5a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 586, "timestamp_epoch": "1566329464.577181000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "12,14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a1ab5221f03e19a7b2625448", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 601, "timestamp_epoch": "1566329464.947555000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "reginald.chandler" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-64fa101af26fc94d4354db74", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 604, "timestamp_epoch": "1566329464.948387000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7fabaf49b4eac70afe6baef1", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1566329464.948829000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b365350d6402f315b40556a1", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1566329464.949355000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-804474f5f5adfc7da25f8f49", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 619, "timestamp_epoch": "1566329464.954888000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-32c8c4a156439a81391c125f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1566329464.955707000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c6dce0b3a41ee63a262340a2", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 631, "timestamp_epoch": "1566329464.960697000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e1924521510a2ec33e0a2a22", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 632, "timestamp_epoch": "1566329464.960939000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c49698a6126b093f9ca6597f", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 636, "timestamp_epoch": "1566329464.961628000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-920bdb9f074e995e7feb41fd", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1566329464.962367000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-39bc8b806cf867c69fc4b9ce", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 638, "timestamp_epoch": "1566329464.962669000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1f9d3d3bd9ce3e2829b4eba2", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 639, "timestamp_epoch": "1566329464.962879000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9597b7a5a61c52891536cf9a", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 640, "timestamp_epoch": "1566329464.963861000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-77dddb9653f3b19b67eef8e4", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 641, "timestamp_epoch": "1566329464.964279000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-797ab5a21da484a8cdeb2cdd", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 642, "timestamp_epoch": "1566329464.964588000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a89c12c7159da1189d2918cd", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1566329464.964857000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ca1a2a17d6335994a4a4f410", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 656, "timestamp_epoch": "1566329466.561099000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c636e50460c94023cb6656e5", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 657, "timestamp_epoch": "1566329466.561442000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3b4021d27e7663a499211edb", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 658, "timestamp_epoch": "1566329466.561737000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-575d09154f0a00969ce92ff0", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1566329466.561997000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3fac2749999c6704905536e2", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1566329466.562313000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-50448664ea2994ca7be5e76c", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1566329466.562711000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-eab41c1f6b2d49ff745d097d", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 663, "timestamp_epoch": "1566329466.563000000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-150b0107890703f4bda86eda", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 664, "timestamp_epoch": "1566329466.563325000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ba1af95ee96870939460c62f", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1566329466.563515000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f4cce608197354c062709083", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 666, "timestamp_epoch": "1566329466.563710000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4eeaf03f7ae25c2077f60151", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 668, "timestamp_epoch": "1566329478.557570000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-abd53c12b206745f304f1063", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 669, "timestamp_epoch": "1566329478.557778000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d732091ff5719f309f43622b", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 679, "timestamp_epoch": "1566329490.553429000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e33ab10841f7cf360ce2c2e1", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 680, "timestamp_epoch": "1566329490.553726000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b5f5c9a4e26abc22d6d72524", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1234, "timestamp_epoch": "1566329501.650816000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-59dec0064cbe1f64980bd076", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1235, "timestamp_epoch": "1566329501.651134000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-990009f86a6b2699b22b5f6c", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1236, "timestamp_epoch": "1566329501.651487000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-dc31aa8bd9bc5eb25b804a81", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1237, "timestamp_epoch": "1566329501.651695000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-69cfdc97668f2e4e901e37cf", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1238, "timestamp_epoch": "1566329501.651901000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9b21891575259be640cf19f2", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1239, "timestamp_epoch": "1566329501.652083000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-20f68d69bcc575309133403b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1240, "timestamp_epoch": "1566329501.652984000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e58edbf01c204c444d0c08f1", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1241, "timestamp_epoch": "1566329501.653256000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7941378eb7064600d6c91cf8", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1242, "timestamp_epoch": "1566329501.667326000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-eac225868aa73f246e1fba19", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1243, "timestamp_epoch": "1566329501.667524000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-aa968aa44a5cd0899541a91a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1244, "timestamp_epoch": "1566329501.667801000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7e2cf26abeb93f0ef98503cf", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1245, "timestamp_epoch": "1566329501.776613000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fe157e37de200355027d97e5", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 1247, "timestamp_epoch": "1566329502.549906000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b1615c1417affeb8b2fa5ab8", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 1248, "timestamp_epoch": "1566329502.550096000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-41e23ca3bad24db5a945fadf", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 1249, "timestamp_epoch": "1566329502.552410000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8584c3b502181a05c9c9eada", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 1250, "timestamp_epoch": "1566329502.552677000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-853bd2d03313c7713e79739d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1256, "timestamp_epoch": "1566329514.551431000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c7de97952792b4bb8bb05f4a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1257, "timestamp_epoch": "1566329514.551622000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0e64812f21f5a457a744760e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1303, "timestamp_epoch": "1566329625.430259000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3c5734943bdec4549f2eee9a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1304, "timestamp_epoch": "1566329625.432538000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-175d9dbb4e17e3fe75363052", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1305, "timestamp_epoch": "1566329625.434676000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b8aef57028a975dfc9983f8f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1306, "timestamp_epoch": "1566329625.434887000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d71663f5610fb12e876cb85a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1307, "timestamp_epoch": "1566329625.436999000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-89d1d5313c8a892f6c466ac8", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1308, "timestamp_epoch": "1566329625.437179000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0fa4d0ee9075fb9257f81a8c", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1309, "timestamp_epoch": "1566329625.439808000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8e27d085dfa1a3cc41502c88", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1310, "timestamp_epoch": "1566329625.439986000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-48ab5aafdd359a092eaba16d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1311, "timestamp_epoch": "1566329625.441042000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8bd336f7ef275a201828ce1a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1312, "timestamp_epoch": "1566329625.441320000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f353f3bdc8daf86c4c58ac48", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1314, "timestamp_epoch": "1566329647.592923000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9e97232977ec497df34b188a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 1315, "timestamp_epoch": "1566329647.593223000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "wpad" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5d23734cf36ddf871a749689", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 1321, "timestamp_epoch": "1566329681.345756000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "wpad" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6c5138d16e9bc9cbe9826d70", "src_port": null, "tcp_stream": null, "udp_stream": 35, "frame_number": 1323, "timestamp_epoch": "1566329681.444587000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3d91f7e0a696c032c8f02c46", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1337, "timestamp_epoch": "1566329681.647048000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-80a1e1efcc3ab0c866ae508e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1360, "timestamp_epoch": "1566329682.410439000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-df518e6747410511b36b1e39", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1365, "timestamp_epoch": "1566329683.174918000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d634a42c20103b73b1fefc0b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1366, "timestamp_epoch": "1566329702.652193000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cfd066ca7f155e50862ec57e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1437, "timestamp_epoch": "1566329703.408151000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f8e65a8cc528e14c0192358b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1442, "timestamp_epoch": "1566329704.172489000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-54b5b1072c9409f08d833581", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1443, "timestamp_epoch": "1566329723.927981000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f2e86b94e991cbe5e9b67ec6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1497, "timestamp_epoch": "1566329724.688520000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-078bfbdb33a40f37c33d4064", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1687, "timestamp_epoch": "1566329725.451595000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-49acdca50bd1364be0f4985b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1971, "timestamp_epoch": "1566329796.428864000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0e971b4deb7bde3856e88e23", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2009, "timestamp_epoch": "1566329797.188059000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ed06b2a9ae69999f64ced232", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2010, "timestamp_epoch": "1566329797.952199000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9046142aac33881e788d524b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2106, "timestamp_epoch": "1566330059.793395000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d60464c4c602795c67694ec0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2107, "timestamp_epoch": "1566330059.793785000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-58c08658556e48c7f471bb8d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2108, "timestamp_epoch": "1566330059.795014000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3afb41f2dc3323647b25bec4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2109, "timestamp_epoch": "1566330059.795457000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cbb38cddd1f90c3568cc3928", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2110, "timestamp_epoch": "1566330059.795930000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f0b7f11d48375a4d750cffff", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2111, "timestamp_epoch": "1566330059.796135000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-72a71c7ba4e26dd4f1af24c6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2112, "timestamp_epoch": "1566330059.796338000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6d90dc9f26e8a867b5758a7c", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2113, "timestamp_epoch": "1566330059.796525000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-35de35d492cf1053880cdb9d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2114, "timestamp_epoch": "1566330059.799883000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b44c25e05e783e93a9f5ebc9", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 2115, "timestamp_epoch": "1566330059.800091000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f97c67591515c9a33907ff12", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3080, "timestamp_epoch": "1566330148.552779000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9844c28e15f7578dffdc6374", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3081, "timestamp_epoch": "1566330148.553119000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9382b8deadb15a67e0d8a1b7", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3087, "timestamp_epoch": "1566330196.160207000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-41a894578ca5f2530567bc9e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3088, "timestamp_epoch": "1566330196.160495000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-80fcd442abf9d7cd3e1be8c0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3089, "timestamp_epoch": "1566330196.160892000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-651cb1a41b7665f23bd7bd63", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3090, "timestamp_epoch": "1566330196.161071000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-607e2788a8a012ff69af770e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3091, "timestamp_epoch": "1566330196.161310000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-99b5c2f18f9f2b9053234558", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3092, "timestamp_epoch": "1566330196.161486000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-36097d639967ef56986e3d53", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3093, "timestamp_epoch": "1566330196.161714000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5384946ce7e0dc7da4b56ba4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3094, "timestamp_epoch": "1566330196.161870000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8040981d3cce7f4794054116", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3095, "timestamp_epoch": "1566330196.162365000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fb0de9f50065c26da09eaaac", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3096, "timestamp_epoch": "1566330196.162528000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-217f9acf225a86554319d7d2", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3113, "timestamp_epoch": "1566330237.763064000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c72bbee86200c2c2ed88df89", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3114, "timestamp_epoch": "1566330237.763430000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9e06efee38e170c576c9a7e5", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3115, "timestamp_epoch": "1566330237.765233000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d3c3b0b4f056d462e7719ba9", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3116, "timestamp_epoch": "1566330237.765417000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8aa8b2a30aec743791c42ac6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3117, "timestamp_epoch": "1566330237.768604000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a56205bc37bd1b10386bc7fe", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3118, "timestamp_epoch": "1566330237.768765000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fe17f4774ad0e0c4f89ecaa7", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3119, "timestamp_epoch": "1566330237.769218000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ec963bf5aa5734219b3f22fd", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3120, "timestamp_epoch": "1566330237.769367000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4eb8e81450d18854a9482523", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3121, "timestamp_epoch": "1566330237.771147000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ed79d9d03432e5470cf6aec4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3122, "timestamp_epoch": "1566330237.771337000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-eefba315b58c0742bda7e074", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3124, "timestamp_epoch": "1566330238.911196000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e339ae390805f210fe3eb96f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3125, "timestamp_epoch": "1566330238.911461000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0348169b42ff9a06de2d02ab", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3126, "timestamp_epoch": "1566330238.912230000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8ec1ec4bcaedfd5b7df05a11", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3127, "timestamp_epoch": "1566330238.912409000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6b762c10bfc0a028c3f7ce71", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3128, "timestamp_epoch": "1566330238.913084000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d7181160342d4fde1720bb76", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3129, "timestamp_epoch": "1566330238.913249000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a54ca0f402c213e1a9678c8d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3131, "timestamp_epoch": "1566330239.171854000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a6e9c346a3933a2e97139b88", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3132, "timestamp_epoch": "1566330239.174418000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-48bacf5680dd4c4a7f9db948", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3134, "timestamp_epoch": "1566330239.174757000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f0e78f71610ccd2cab7bdd8b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3135, "timestamp_epoch": "1566330239.175191000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4410fdeacdafc6430a3c674b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3136, "timestamp_epoch": "1566330239.175428000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8d27afcb9e8e74b6c6f441a4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3137, "timestamp_epoch": "1566330239.175677000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-16c196550924ef076ea09d17", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3138, "timestamp_epoch": "1566330239.179158000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cc1636071c5f3bf040d6f3c6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3139, "timestamp_epoch": "1566330239.180205000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8dde033795574d3f58628600", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3140, "timestamp_epoch": "1566330239.180391000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8b7814ed68695df01da11b3f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3141, "timestamp_epoch": "1566330239.187877000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c3dbaad39152ccb95a10532f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3142, "timestamp_epoch": "1566330239.187968000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4b3d12e08be080efcb842141", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3144, "timestamp_epoch": "1566330239.271821000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ee9094c972e3a47115b0e8be", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3145, "timestamp_epoch": "1566330239.272036000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c6d2a7566908a65d4637da29", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3146, "timestamp_epoch": "1566330239.273612000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5a3ff184f1b7a090a02c2baa", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3147, "timestamp_epoch": "1566330239.273796000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d9a406aaa31837c6e1e592fd", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3148, "timestamp_epoch": "1566330239.385194000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d59d320a7c8dcfcddc04b477", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3149, "timestamp_epoch": "1566330239.385482000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b017a4e95f78f2580bc189c4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3150, "timestamp_epoch": "1566330239.385853000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0c866275ca9bbca9847aa1a8", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3151, "timestamp_epoch": "1566330239.386204000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8a395a061277428789382347", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3153, "timestamp_epoch": "1566330244.202751000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-85ba71348212c3336104d71b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3154, "timestamp_epoch": "1566330244.202950000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cdb91864d0fc71726860e5fb", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3155, "timestamp_epoch": "1566330244.203649000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5702688cdb33f053bb56fe4a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3156, "timestamp_epoch": "1566330244.203794000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-032e8767925eb0606bce74e2", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3158, "timestamp_epoch": "1566330252.557534000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5f55e5bc1aac31f8f0cb8a11", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3159, "timestamp_epoch": "1566330252.557763000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-62757c3cf58962abb4d66cdb", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3161, "timestamp_epoch": "1566330286.962344000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-43719edb550d6c542c06191f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3162, "timestamp_epoch": "1566330286.962647000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5be30c0bf4c412c7256db74e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3163, "timestamp_epoch": "1566330286.963659000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d72aea6a0dfc2581cee95254", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3164, "timestamp_epoch": "1566330286.963963000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e6a7f77ac63b603fdb67e729", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3165, "timestamp_epoch": "1566330286.964245000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-db3b262f64e71d87d7ce07f1", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3166, "timestamp_epoch": "1566330286.964408000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d3e7e334f78e40f11b4e7508", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3167, "timestamp_epoch": "1566330286.964891000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-25f982bf3c02643592578e8e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3168, "timestamp_epoch": "1566330286.965043000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-25079f975a7181bf827c0111", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3169, "timestamp_epoch": "1566330286.966413000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cbbcbbda8877379018e7d6c7", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3170, "timestamp_epoch": "1566330286.966587000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cdc0610f354cef1f7976ebff", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3172, "timestamp_epoch": "1566330304.156241000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-897c3ac329babc96d163d761", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3173, "timestamp_epoch": "1566330304.156564000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-374257bf7221b976382481e3", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3174, "timestamp_epoch": "1566330304.156971000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-300b7c48d38320fd18bbd284", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3175, "timestamp_epoch": "1566330304.157190000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-11b354ebba958d5fb7b0bc41", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3176, "timestamp_epoch": "1566330304.157532000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1ba3bc14187b3b3bc7cb93bc", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3177, "timestamp_epoch": "1566330304.157673000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cf3a33cdd324555904d6ff7e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3178, "timestamp_epoch": "1566330304.159574000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f9581ae26e64223d82f8f386", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3179, "timestamp_epoch": "1566330304.159733000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3ae72ca9a6225251cc6ab236", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3180, "timestamp_epoch": "1566330304.160599000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1b5e8f764b2ae0d944966df0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3181, "timestamp_epoch": "1566330304.160748000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b132915882d5ddfdc594c2bd", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3187, "timestamp_epoch": "1566330350.554240000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-142d210c31db09438d2264f8", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3188, "timestamp_epoch": "1566330350.554390000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e3663cbae5ba509fdb70bf46", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3189, "timestamp_epoch": "1566330350.554620000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4cf532ffb4dd99eb35353e55", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3192, "timestamp_epoch": "1566330350.555669000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1b6103143ef429751c9ebed0", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3194, "timestamp_epoch": "1566330350.556702000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6d5bdf1b18ab4ba5a2573114", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3195, "timestamp_epoch": "1566330350.557079000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2145369a4634ce667979b035", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3196, "timestamp_epoch": "1566330350.557202000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0de9192b47bbd8a46aa228c6", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3197, "timestamp_epoch": "1566330350.557459000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7391f2e06557635fb8e6a06b", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3198, "timestamp_epoch": "1566330350.557724000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d60082c5f209de526ad03d3a", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3200, "timestamp_epoch": "1566330366.558710000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c247162643570f52507abf5b", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3201, "timestamp_epoch": "1566330366.558970000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-af631b6ad02eb7e53f99a908", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3202, "timestamp_epoch": "1566330366.559206000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1d7f6251a520a67b80b16acc", "src_port": null, "tcp_stream": 69, "udp_stream": null, "frame_number": 3203, "timestamp_epoch": "1566330366.559447000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-62a8f35590a9c956e80f7506", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3205, "timestamp_epoch": "1566330395.529047000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-16c454f93cff2cf01124fdc3", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3206, "timestamp_epoch": "1566330395.529383000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a50bd29fc069b30a34d9791d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3207, "timestamp_epoch": "1566330395.529722000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-22c17227efa0478a345f2eaa", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3208, "timestamp_epoch": "1566330395.529886000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c212ddb9ecd53a3b69f490ec", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3209, "timestamp_epoch": "1566330395.530081000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a5f3dbd5a2d4380f1d31b5d9", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3210, "timestamp_epoch": "1566330395.530224000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5f2b25d6e7747e3268fa453d", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3211, "timestamp_epoch": "1566330395.530422000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b64015fddd9681f584573ec0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3212, "timestamp_epoch": "1566330395.530587000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6ea2f719f57c19e85fe3aa1a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3213, "timestamp_epoch": "1566330395.531088000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-39ea0db1572974cd7be80c3c", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 3214, "timestamp_epoch": "1566330395.531255000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a991e8a40410c87dae13d39a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 4047, "timestamp_epoch": "1566330497.842675000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b1fcc16b538e3f7c39adb28e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 4048, "timestamp_epoch": "1566330497.842935000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b9fe11e0af71d59dbab992ea", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 4049, "timestamp_epoch": "1566330497.845175000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8e4cb1cdb1e6ae3f98855652", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 4050, "timestamp_epoch": "1566330497.949436000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d912621c4e92a0199e690f0a", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 4062, "timestamp_epoch": "1566330510.564048000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d7ecdbe0fa823f2706931dcf", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 4063, "timestamp_epoch": "1566330510.564414000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e007b299f26f25a4096e5ee0", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6074, "timestamp_epoch": "1566330592.428796000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1b>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-81c954250eeec73a7aef0fa6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6075, "timestamp_epoch": "1566330592.428954000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "nbns.name": "BADBUNDT<1b> (Domain Master Browser)", "nbns.flags.opcode": "0", "nbns.flags.response": "True", "nbns.nb_flags.group": "False" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6e6d49fa243360471dbc30c1", "src_port": null, "tcp_stream": null, "udp_stream": 55, "frame_number": 6076, "timestamp_epoch": "1566330592.429664000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-02dd1ec828e5b3e80481a2fc", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6077, "timestamp_epoch": "1566330592.430291000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1403fb91b26ea080ab28e833", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6078, "timestamp_epoch": "1566330593.434989000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c95ad80378604d3428620eb6", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6079, "timestamp_epoch": "1566330593.435691000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6a8b6c0a3831e96f7302e9e5", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6082, "timestamp_epoch": "1566330594.450277000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2911ce853e3f740c25d01dc3", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6083, "timestamp_epoch": "1566330594.450565000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-868311449c4d28d3acb30164", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6100, "timestamp_epoch": "1566330595.462723000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e73679ae77f1382ac2aa1af3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6103, "timestamp_epoch": "1566330596.227207000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-93a6ebff9c55b0fc72f9f4ec", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6108, "timestamp_epoch": "1566330596.992198000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7f102097cd5f75a5b283322a", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6853, "timestamp_epoch": "1566330600.638548000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6e5aa1113dd0e26b3ee8ac95", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6854, "timestamp_epoch": "1566330600.638661000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b100277bcc07c7b6fd1eb90b", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6855, "timestamp_epoch": "1566330601.640296000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c7bda69cb425a6cea1daa5d3", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6856, "timestamp_epoch": "1566330601.640451000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-96814874f4ae7cad83ca9fd3", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6857, "timestamp_epoch": "1566330602.654518000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-28790606773320347f7f43f1", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6858, "timestamp_epoch": "1566330602.654745000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b1fd50536c25945a11d118a9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6859, "timestamp_epoch": "1566330603.669080000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9920d907aebb818a0c1d72ba", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6860, "timestamp_epoch": "1566330604.432331000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-af5712fd86eba05435cc1653", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6861, "timestamp_epoch": "1566330605.198015000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e09088f3c8329bbaafe17a67", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6862, "timestamp_epoch": "1566330605.962615000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fb7593595f7289ae47806be2", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6863, "timestamp_epoch": "1566330605.962778000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-51b37630abb755229578b9f1", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6868, "timestamp_epoch": "1566330606.976555000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-95105f4ddf6b450c58b0a55f", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6869, "timestamp_epoch": "1566330606.976919000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fee4822dda7316797241281f", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6871, "timestamp_epoch": "1566330607.990914000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ea1786585b131fb1796972ec", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6872, "timestamp_epoch": "1566330607.991080000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9f5e584a59c941c245bc12fa", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6874, "timestamp_epoch": "1566330609.004204000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1ad58eb3adbce26d84cf956f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6875, "timestamp_epoch": "1566330609.769121000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e983bf81ba46a84475547933", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6880, "timestamp_epoch": "1566330610.533654000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-791f5f69479a6c8e93785633", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6883, "timestamp_epoch": "1566330611.297142000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7ab68ba714440f3cf39e088b", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6884, "timestamp_epoch": "1566330611.297327000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5c5c9a8a9fbae92ad797b8a2", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6885, "timestamp_epoch": "1566330612.312158000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-78400c304a3ab5f66a605aa2", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6886, "timestamp_epoch": "1566330612.312314000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6a3ce69880056e14d81da307", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6907, "timestamp_epoch": "1566330613.324967000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-02135007f98e6bc9d26718b8", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6908, "timestamp_epoch": "1566330613.325218000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5e4930e5505c112963285f03", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6911, "timestamp_epoch": "1566330614.340201000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-391943b90a8b7e8965fcb841", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6912, "timestamp_epoch": "1566330615.103254000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2887a92f60622fa07dae93d1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 6913, "timestamp_epoch": "1566330615.867245000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-af7ea880b68f10faaac48978", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6933, "timestamp_epoch": "1566330617.647961000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-144904b2a7e7c0e65660f024", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6934, "timestamp_epoch": "1566330617.648087000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-343643ce04e3b062c1d3b06b", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 6953, "timestamp_epoch": "1566330618.660815000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3ccfcccf1d719fee7d4fbaed", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 6954, "timestamp_epoch": "1566330618.661102000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0f2f712236f4de9633896293", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 7741, "timestamp_epoch": "1566330619.674092000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2e61cb3ec00424e20ecebd0c", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 7742, "timestamp_epoch": "1566330619.674258000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0d5d242e0605eb6c52a54e88", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7750, "timestamp_epoch": "1566330620.688335000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-780f85599e972be63260e7bd", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7752, "timestamp_epoch": "1566330621.452874000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-83bfd74ac4275546030d01d0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7767, "timestamp_epoch": "1566330622.216721000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6695c9652f21578773b08145", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 8101, "timestamp_epoch": "1566330623.996112000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fe9df82ee6ca36a990e0dd93", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 8102, "timestamp_epoch": "1566330623.996221000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bf031c12abcf398c09c694cf", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 8343, "timestamp_epoch": "1566330625.009216000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6aff2bdbcd3b25229bd8869d", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 8344, "timestamp_epoch": "1566330625.009380000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-96b1d53cf3a3bf65d8207492", "src_port": null, "tcp_stream": 92, "udp_stream": null, "frame_number": 8580, "timestamp_epoch": "1566330625.698565000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7135349274ca0e0f24eff88d", "src_port": null, "tcp_stream": 92, "udp_stream": null, "frame_number": 8581, "timestamp_epoch": "1566330625.698871000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2e170402cb512ad60ae47de8", "src_port": null, "tcp_stream": 92, "udp_stream": null, "frame_number": 8582, "timestamp_epoch": "1566330625.700059000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3005e6c510c27544bda53f09", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 8715, "timestamp_epoch": "1566330626.025263000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-aafc27f00573500e65ec04bf", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 8716, "timestamp_epoch": "1566330626.025476000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-08acec3c2bf9c5115eabc7c6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 8735, "timestamp_epoch": "1566330627.038583000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0f800cd0df006c56c4427558", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 8738, "timestamp_epoch": "1566330627.801341000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6d3e75e03e76836f44fd67d3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 8743, "timestamp_epoch": "1566330628.566573000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a6d609bc28fa5659003691df", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 8746, "timestamp_epoch": "1566330630.346203000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-26c59d65b55fbf39f2706f6f", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 8747, "timestamp_epoch": "1566330630.346364000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-00452a880bb2f6595a77c534", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 8824, "timestamp_epoch": "1566330630.930325000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-06002fdcad62af09fa83f5a2", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 8825, "timestamp_epoch": "1566330630.930506000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ef7564b209a471ee7b1eca29", "src_port": null, "tcp_stream": 94, "udp_stream": null, "frame_number": 8826, "timestamp_epoch": "1566330630.930734000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-87467a548ec662bf665cedd9", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 8962, "timestamp_epoch": "1566330631.358629000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5afa7124cd956b221b2ef5d5", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 8963, "timestamp_epoch": "1566330631.358893000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-21de9b44dd6a4051aabc944e", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 8964, "timestamp_epoch": "1566330632.372659000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1339e9e161db157042db8455", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 8965, "timestamp_epoch": "1566330632.372816000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a52166078114bf98abea0baa", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8977, "timestamp_epoch": "1566330632.476084000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cdecdf32083e8d21ea36117e", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8979, "timestamp_epoch": "1566330632.476751000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7a7053606ea44685d326c2dd", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8980, "timestamp_epoch": "1566330632.477302000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-de57fcf80160f1f226348662", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9008, "timestamp_epoch": "1566330632.609641000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8b2b7ced390f2dcbc39fe31f", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9010, "timestamp_epoch": "1566330632.610263000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-33bc8e4cfe61e515f20e3d72", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9231, "timestamp_epoch": "1566330632.702310000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b7e7deed866eae7ccdd7c736", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9233, "timestamp_epoch": "1566330632.703184000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "wpad" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bbcdfa9a0939cb0417ef4203", "src_port": null, "tcp_stream": null, "udp_stream": 63, "frame_number": 9402, "timestamp_epoch": "1566330632.779520000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:18:f3:a6:01:92", "dns.qry.name": "wpad" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-add6d9d4904a72a3a7cd18b6", "src_port": null, "tcp_stream": null, "udp_stream": 63, "frame_number": 9404, "timestamp_epoch": "1566330632.886808000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-61cda2bd0bb3e0bb589e6ed7", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9418, "timestamp_epoch": "1566330633.090097000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dc9c057526adb27e17370c1d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9419, "timestamp_epoch": "1566330633.387153000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-16ada054a68994393d20bd3d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9422, "timestamp_epoch": "1566330633.854280000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d1299c3a0eeed7a993dfd78e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9427, "timestamp_epoch": "1566330634.150591000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6d96cc834869934539bd1264", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9428, "timestamp_epoch": "1566330634.618480000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fe379dabbb748e8f005dbfc3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9429, "timestamp_epoch": "1566330634.916626000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b1e27ed7b7100bc8ecd164c1", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9548, "timestamp_epoch": "1566330636.694809000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a89026de0e85f5cd5ff5ddeb", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9549, "timestamp_epoch": "1566330636.695207000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ba56662509855c41e8896d05", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9554, "timestamp_epoch": "1566330637.708353000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bcccc2dfc486f75fff793c9e", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9555, "timestamp_epoch": "1566330637.708565000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-94725efed5b9ddaaa5a76e4d", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9560, "timestamp_epoch": "1566330638.721363000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-66e27192a1a9be1d6943e888", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9561, "timestamp_epoch": "1566330638.721513000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6a5f7152b39d9b071b1462a3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9562, "timestamp_epoch": "1566330639.735409000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-360c43af581ca8a8eb7928b2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9563, "timestamp_epoch": "1566330640.500676000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-df59a34d555e85f17f4d4bd9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9683, "timestamp_epoch": "1566330641.264022000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-be93994881b9ed7c64fb305a", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9684, "timestamp_epoch": "1566330643.045214000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fb9802be0d90aab04512dc9a", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9685, "timestamp_epoch": "1566330643.045396000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4f15890ffd9a041215c5af6d", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9686, "timestamp_epoch": "1566330644.056979000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d146b7feabbe823e160dadc8", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9687, "timestamp_epoch": "1566330644.057173000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c3212b07a0a0722196d679b1", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9688, "timestamp_epoch": "1566330645.070743000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-668dfafce880ffc8c3081820", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9689, "timestamp_epoch": "1566330645.070937000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-606c847f6d0b231055d0c505", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9690, "timestamp_epoch": "1566330646.084681000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8f040a756453f1e8b3136868", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9808, "timestamp_epoch": "1566330646.850700000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3fb371da50bf38f97d79524b", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9811, "timestamp_epoch": "1566330647.614336000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e9656a99f63274fc673aa4e4", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9866, "timestamp_epoch": "1566330648.568400000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0120a322b54fffd4e303f792", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9867, "timestamp_epoch": "1566330648.568531000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fc3ae750b0d20be5022972be", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9873, "timestamp_epoch": "1566330649.580078000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-83f08551db2804bf9c64339f", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9874, "timestamp_epoch": "1566330649.580300000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e1210077c55b61e416aef584", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 9876, "timestamp_epoch": "1566330650.593296000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a0f9e0a2f260e98955418a74", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 9877, "timestamp_epoch": "1566330650.593507000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-81019f0d49d22bbff4cb4ae4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9996, "timestamp_epoch": "1566330651.607135000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2e9979084df54241b7007522", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9997, "timestamp_epoch": "1566330652.371400000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-81775e6628c00f0c59f76c2f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10000, "timestamp_epoch": "1566330653.135656000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c009371a5d65504dfe202faf", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 10001, "timestamp_epoch": "1566330653.901621000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1dde96f3f6561e011f04c558", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 10002, "timestamp_epoch": "1566330653.901820000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-accc946ad02cdb9bfb4e4d79", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 10003, "timestamp_epoch": "1566330654.916127000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-aeb5646a9e5701f1a4f47caf", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 10004, "timestamp_epoch": "1566330654.916320000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-91ad2c023ebbe5f9e5bf45fe", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10015, "timestamp_epoch": "1566330654.945945000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-219e708d5e747b5edf0a81d6", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10017, "timestamp_epoch": "1566330654.946507000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1822c2da8cdf4dce3022e76e", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 10435, "timestamp_epoch": "1566330655.929219000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3b1b522c3a7cf79de4f39c0e", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 10436, "timestamp_epoch": "1566330655.929344000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9e3b4c4ffb552625a74417f2", "src_port": null, "tcp_stream": 124, "udp_stream": null, "frame_number": 10483, "timestamp_epoch": "1566330656.180929000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-447c67923a7ba5e64a4292c3", "src_port": null, "tcp_stream": 124, "udp_stream": null, "frame_number": 10484, "timestamp_epoch": "1566330656.181367000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8f00bad371221e09c54eeabf", "src_port": null, "tcp_stream": 124, "udp_stream": null, "frame_number": 10485, "timestamp_epoch": "1566330656.181668000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cd333d969f0c6b80f965a066", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10721, "timestamp_epoch": "1566330656.943303000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-63a3ed79583d939c8b8395b8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10837, "timestamp_epoch": "1566330657.707833000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c81172a7ae3d34b059f5d0ab", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 10982, "timestamp_epoch": "1566330658.471043000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d887687cc72b334b33982ca4", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 11262, "timestamp_epoch": "1566330660.252504000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-76a6adab48af9ca79ce76de2", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 11263, "timestamp_epoch": "1566330660.252699000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e8783e1efd11d454691e201a", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 11300, "timestamp_epoch": "1566330661.264246000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d35e81c83327de54ce6fceb5", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 11301, "timestamp_epoch": "1566330661.264418000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-187a9bd02372ceec004d9876", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 11421, "timestamp_epoch": "1566330662.279301000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d8f2106bfb42c81bff15c503", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 11422, "timestamp_epoch": "1566330662.279786000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a701c8a6263f2ed723fce757", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11428, "timestamp_epoch": "1566330663.293392000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-57a53eb153a5e2e9463b36b1", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11429, "timestamp_epoch": "1566330664.055937000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a9ee169c9bb80b7b9d674a00", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11434, "timestamp_epoch": "1566330664.820267000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-534cc7413c77d14838ec1635", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 11553, "timestamp_epoch": "1566330666.601296000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-daaf39feeee1c08916d298b7", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 11554, "timestamp_epoch": "1566330666.601500000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c11f246684b189923d85bf3c", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 11560, "timestamp_epoch": "1566330667.613501000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-49f38e3553adb742adf9fd18", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 11561, "timestamp_epoch": "1566330667.613703000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7f7600076a42a268dd1991b5", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 11562, "timestamp_epoch": "1566330668.628069000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6e9ee02d97f2be9940b38695", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 11563, "timestamp_epoch": "1566330668.628248000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-94acde49ce531d17863643db", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11566, "timestamp_epoch": "1566330669.641883000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f863b6c9ce0f22f6af7a83ff", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11571, "timestamp_epoch": "1566330670.405110000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a9443044fcffb586cce92f89", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 11573, "timestamp_epoch": "1566330671.169640000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d1dd68717f9dcdf6299e6c8d", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 11837, "timestamp_epoch": "1566330681.438440000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7a398b7693ad304bd51642af", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 11838, "timestamp_epoch": "1566330681.438712000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9920e100855cb12412d97583", "src_port": null, "tcp_stream": 125, "udp_stream": null, "frame_number": 11839, "timestamp_epoch": "1566330681.439029000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ae74382647994466016c5ed4", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 11856, "timestamp_epoch": "1566330681.441736000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-62d2c54263ad3735e0af1c6d", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 11857, "timestamp_epoch": "1566330681.441913000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-47504926228e418bd091e406", "src_port": null, "tcp_stream": 126, "udp_stream": null, "frame_number": 11858, "timestamp_epoch": "1566330681.442165000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-288ae36b0bf7ff0872370786", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 12065, "timestamp_epoch": "1566330686.671881000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a1440a7ad86c515792f0e5b2", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 12066, "timestamp_epoch": "1566330686.672102000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-19768f77a3b77006e4cbf18b", "src_port": null, "tcp_stream": 127, "udp_stream": null, "frame_number": 12067, "timestamp_epoch": "1566330686.672321000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2488fee974f354335f1705d4", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 12529, "timestamp_epoch": "1566330701.913955000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-68c6ccc8eb918309f8e9531a", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 12530, "timestamp_epoch": "1566330701.914132000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6a8eb642d21d9ab99fc1cc9d", "src_port": null, "tcp_stream": 129, "udp_stream": null, "frame_number": 12531, "timestamp_epoch": "1566330701.914327000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5b373912f075eb166d70d602", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 13647, "timestamp_epoch": "1566330712.145120000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c47c4f65b00ae85831beae3b", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 13648, "timestamp_epoch": "1566330712.145287000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-caaffefbfb6bd716356be936", "src_port": null, "tcp_stream": 131, "udp_stream": null, "frame_number": 13649, "timestamp_epoch": "1566330712.145486000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f4392e2720d4ff58d82709e7", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 13667, "timestamp_epoch": "1566330712.147349000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e69b4a86fd7bfcaff413d126", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 13668, "timestamp_epoch": "1566330712.147496000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "NULL", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5cf5003d6887eedbaf984979", "src_port": null, "tcp_stream": 132, "udp_stream": null, "frame_number": 13669, "timestamp_epoch": "1566330712.147651000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a2a56ac237dfd9f1c3bee1e5", "src_port": null, "tcp_stream": 134, "udp_stream": null, "frame_number": 14312, "timestamp_epoch": "1566330737.383044000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-02641ed61d2df7511eae1e1e", "src_port": null, "tcp_stream": 134, "udp_stream": null, "frame_number": 14313, "timestamp_epoch": "1566330737.383282000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c7be1f9e43422deed29a33fd", "src_port": null, "tcp_stream": 134, "udp_stream": null, "frame_number": 14314, "timestamp_epoch": "1566330737.383481000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d58d2aad78abc5d6dcca74a9", "src_port": null, "tcp_stream": 135, "udp_stream": null, "frame_number": 14877, "timestamp_epoch": "1566330757.621392000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8d24eecf4dad01ec924a13f5", "src_port": null, "tcp_stream": 135, "udp_stream": null, "frame_number": 14878, "timestamp_epoch": "1566330757.621591000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-01576189f9c7dba475dfca9e", "src_port": null, "tcp_stream": 135, "udp_stream": null, "frame_number": 14879, "timestamp_epoch": "1566330757.621864000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4ada8e3b67c6506179124284", "src_port": null, "tcp_stream": 136, "udp_stream": null, "frame_number": 15499, "timestamp_epoch": "1566330782.872513000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bd1a99fad51c66d97faeb658", "src_port": null, "tcp_stream": 136, "udp_stream": null, "frame_number": 15500, "timestamp_epoch": "1566330782.872821000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2fbbc912f18d47297b043e92", "src_port": null, "tcp_stream": 136, "udp_stream": null, "frame_number": 15501, "timestamp_epoch": "1566330782.873142000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-690c3add160bbd9fc3e8cd29", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 15518, "timestamp_epoch": "1566330782.875600000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ace98c858593c598eb0bf68e", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 15519, "timestamp_epoch": "1566330782.875769000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ef8207d9af62ac89145d189a", "src_port": null, "tcp_stream": 137, "udp_stream": null, "frame_number": 15520, "timestamp_epoch": "1566330782.875967000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dee8866e37bc5862190ddf7e", "src_port": null, "tcp_stream": 138, "udp_stream": null, "frame_number": 15846, "timestamp_epoch": "1566330793.111117000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-34d7905f5838f751da667f81", "src_port": null, "tcp_stream": 138, "udp_stream": null, "frame_number": 15847, "timestamp_epoch": "1566330793.111322000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-60b8822a7db07ef32f931578", "src_port": null, "tcp_stream": 138, "udp_stream": null, "frame_number": 15848, "timestamp_epoch": "1566330793.111525000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-27a7cc876d0ca57c982c8b64", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 16465, "timestamp_epoch": "1566330823.372606000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ba1294953bc0e40227acbf34", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 16466, "timestamp_epoch": "1566330823.372872000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ca41327e47ffd017f97285dc", "src_port": null, "tcp_stream": 139, "udp_stream": null, "frame_number": 16467, "timestamp_epoch": "1566330823.373133000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6e51f990eb400ba949e9c982", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 16678, "timestamp_epoch": "1566330828.600132000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-af86119a02150deeec7a1d2a", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 16679, "timestamp_epoch": "1566330828.600332000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "ntlmssp.auth.domain": "BADBUNDT", "ntlmssp.auth.hostname": "NULL", "ntlmssp.auth.username": "NULL" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5dced9a8aa9121089019292a", "src_port": null, "tcp_stream": 140, "udp_stream": null, "frame_number": 16680, "timestamp_epoch": "1566330828.600540000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-20a7c21711f9ee18968cd22e", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 17481, "timestamp_epoch": "1566330835.040978000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-49ca73c83ed79a6b34d8814f", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 17482, "timestamp_epoch": "1566330835.041181000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f514b77b4540e0bd47e722db", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 17484, "timestamp_epoch": "1566330836.049918000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4920c4bfa8bcd0571cc9cd92", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 17485, "timestamp_epoch": "1566330836.050081000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-efd556eacd1c908564cc816d", "src_port": null, "tcp_stream": null, "udp_stream": 54, "frame_number": 17486, "timestamp_epoch": "1566330837.064033000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f043f6e160837d64dec351bd", "src_port": null, "tcp_stream": null, "udp_stream": 56, "frame_number": 17487, "timestamp_epoch": "1566330837.064189000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-21d8cb26800264a2daea21b8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 17488, "timestamp_epoch": "1566330838.078056000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-edd0771229678fcc7b1cb21f", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 17489, "timestamp_epoch": "1566330838.842520000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "BADBUNDT<1e>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ee791fe71a3341afa171e3d8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 17490, "timestamp_epoch": "1566330839.607219000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1cc0a08dfb852e26500f5fb6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17616, "timestamp_epoch": "1566331142.116390000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f4f5511671d409ce5cb307a0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17617, "timestamp_epoch": "1566331142.116744000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bb2c482ab804b6ea1b143d40", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17618, "timestamp_epoch": "1566331142.117271000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a36c9f455c252dfe20c84167", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17619, "timestamp_epoch": "1566331142.119507000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7be2e65e031782676609df62", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17621, "timestamp_epoch": "1566331142.119782000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-956a1343a40defb9b948d474", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17622, "timestamp_epoch": "1566331142.120866000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-689d7af419e2fec2eb81fa49", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17623, "timestamp_epoch": "1566331142.121026000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1b253d9214c99e0c7f3bd5a8", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17624, "timestamp_epoch": "1566331142.134239000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fc792ad67f488d330b0e0a6e", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17626, "timestamp_epoch": "1566331142.158255000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-df5a392ca89a845f53798880", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17627, "timestamp_epoch": "1566331142.158564000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cd783000982cdb3711f8ed96", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17628, "timestamp_epoch": "1566331142.205295000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0b0f31ea52e1d2b21c1b1f88", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17629, "timestamp_epoch": "1566331142.205534000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c8396c907ad173d2c29d02f8", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17630, "timestamp_epoch": "1566331142.206090000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b73ba142072115ff023b26da", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17631, "timestamp_epoch": "1566331142.206242000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a6ea126ab5395cc3c1e3f0f0", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17632, "timestamp_epoch": "1566331142.206476000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5614e5a23e9579631eeaefa1", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17633, "timestamp_epoch": "1566331142.206622000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4d6ed4158cbab6c1dbcf915b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17634, "timestamp_epoch": "1566331142.206846000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c957119cd5cb436c53cc1ef4", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17635, "timestamp_epoch": "1566331142.207018000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f779dee5f3a1a4d78cbf3324", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17637, "timestamp_epoch": "1566331144.270422000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1124573d9c7147a9812c4806", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17638, "timestamp_epoch": "1566331144.270582000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-63351f77b9018a3d293f463b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17639, "timestamp_epoch": "1566331144.272295000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-722cead917b5ca011e572dfd", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17640, "timestamp_epoch": "1566331144.272513000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-296cbda9a66515f23bfa0f59", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17642, "timestamp_epoch": "1566331152.562178000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-60d70627ff500975c79cfbb5", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 17643, "timestamp_epoch": "1566331152.562466000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-058ba2c70899162088449ecd", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17705, "timestamp_epoch": "1566331164.601015000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3cdb0f1cffd77ddd01456e9f", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17707, "timestamp_epoch": "1566331164.601772000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c1b8e9e12d2a007726a43b69", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17822, "timestamp_epoch": "1566331164.705824000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cc6a2c85b52b92e72513bed9", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17824, "timestamp_epoch": "1566331164.706368000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f9268210e265cf1c0b0b2447", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 18231, "timestamp_epoch": "1566331164.837101000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-98cc2f86113b21fcb43df536", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 18234, "timestamp_epoch": "1566331165.586784000" }, { "kind": "identity", "dst_ip": "10.8.20.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:18:f3:a6:01:92", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ff45d76cf123dbad81c2c450", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 18246, "timestamp_epoch": "1566331166.351293000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-042be28f0da28098773064d0", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18291, "timestamp_epoch": "1566331250.569628000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8617d58ba09d9320cf85d8dd", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18292, "timestamp_epoch": "1566331250.569785000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-30043eeaf788cc3270328ee9", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18293, "timestamp_epoch": "1566331250.570007000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92", "kerberos.msg_type": "14" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-85ce0bb1799814f172bca907", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18296, "timestamp_epoch": "1566331250.571259000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7eb08ed4f6014729af86c9cf", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18298, "timestamp_epoch": "1566331250.572034000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-314ab14fb661c7361688c90e", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18299, "timestamp_epoch": "1566331250.572585000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-85a9ea12d56f4e47c8cee505", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18300, "timestamp_epoch": "1566331250.572798000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8b8c9e3784d770a32e16a563", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18301, "timestamp_epoch": "1566331250.573301000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a24a049848ffae89d475d4e3", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18302, "timestamp_epoch": "1566331250.573600000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-22e97b71953289e426aeaf0b", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18304, "timestamp_epoch": "1566331266.550361000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-52baf4f1322867d08954893b", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18305, "timestamp_epoch": "1566331266.550614000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1f6189bc1aaa7ea3b08e79c2", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18306, "timestamp_epoch": "1566331266.550781000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-55e6b39fe2de9e53fe5dfff1", "src_port": null, "tcp_stream": 153, "udp_stream": null, "frame_number": 18307, "timestamp_epoch": "1566331266.550948000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-78631f5b829db76d1ef75ff9", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18315, "timestamp_epoch": "1566331276.614210000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7e4ce24ee2df297283aa0fca", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18316, "timestamp_epoch": "1566331276.614492000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-93c9718c01815b1ec795d9de", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18317, "timestamp_epoch": "1566331276.614858000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1ed2295243c2a65c7c99b72b", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18318, "timestamp_epoch": "1566331276.615043000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a04d550363710ed5822c16b5", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18319, "timestamp_epoch": "1566331276.615231000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c80fdfc1b85923ffbd27e872", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18320, "timestamp_epoch": "1566331276.615380000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e24ba0aa054dd545d2fb20ab", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18321, "timestamp_epoch": "1566331276.615555000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-33dc94747c94e2b5ee4261f6", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18322, "timestamp_epoch": "1566331276.615722000" }, { "kind": "identity", "dst_ip": "10.8.20.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:18:f3:a6:01:92" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-596d829ef0f73c72ea5fa4ab", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18323, "timestamp_epoch": "1566331276.616242000" }, { "kind": "identity", "dst_ip": "10.8.20.101", "fields": { "eth.dst": "00:18:f3:a6:01:92", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ff72bcafc7e0491a64bd65ce", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 18324, "timestamp_epoch": "1566331276.616378000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "63.239.233.90", "fields": { "http.host": "www.msftncsi.com", "http.user_agent": "Microsoft NCSI", "http.request.uri": "/ncsi.txt", "http.response_in": "415", "http.request.method": "GET", "http.request.full_uri": "http://www.msftncsi.com/ncsi.txt" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-00e5096c1864eae206cad588", "src_port": 49183, "tcp_stream": 27, "udp_stream": null, "frame_number": 413, "timestamp_epoch": "1566329455.750243000" }, { "kind": "http_request", "dst_ip": "94.103.87.160", "fields": { "http.host": "bh79sbu.com", "http.request.uri": "/qtra/ttqr.php?l=csuv3.j12", "http.response_in": "1230", "http.request.method": "GET", "http.request.full_uri": "http://bh79sbu.com/qtra/ttqr.php?l=csuv3.j12" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-d6539fce47967cbf8e64ce0c", "src_port": 49202, "tcp_stream": 44, "udp_stream": null, "frame_number": 687, "timestamp_epoch": "1566329493.792567000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b256da47ff0288838f93f46e", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1287, "timestamp_epoch": "1566329570.525266000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b6325633b5b2a76296dbbc8f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1297, "timestamp_epoch": "1566329570.863599000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-365d24c27b070343af8bd01d", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1299, "timestamp_epoch": "1566329573.535572000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0f700ebd7ee99a3a1993ccaa", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1300, "timestamp_epoch": "1566329573.862553000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cfdffba7e2d458d49e261379", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1301, "timestamp_epoch": "1566329576.545804000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2ee169b1a4c4babb8c04f398", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 1302, "timestamp_epoch": "1566329576.873927000" }, { "kind": "http_request", "dst_ip": "172.217.6.174", "fields": { "http.host": "google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi", "http.response_in": "1334", "http.request.method": "GET", "http.request.full_uri": "http://google.com/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-d575558d1e8548d731811ede", "src_port": 49206, "tcp_stream": 50, "udp_stream": null, "frame_number": 1331, "timestamp_epoch": "1566329681.527712000" }, { "kind": "http_request", "dst_ip": "172.217.9.132", "fields": { "http.host": "www.google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png", "http.response_in": "1358", "http.request.method": "GET", "http.request.full_uri": "http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-1246fa54f513570f65426b7a", "src_port": 49207, "tcp_stream": 51, "udp_stream": null, "frame_number": 1345, "timestamp_epoch": "1566329681.671214000" }, { "kind": "http_request", "dst_ip": "172.217.9.132", "fields": { "http.host": "www.google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/errors/robot.png", "http.response_in": "1354", "http.request.method": "GET", "http.request.full_uri": "http://www.google.com/images/errors/robot.png" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-1f53931ea3ce3b71ade4d59b", "src_port": 49208, "tcp_stream": 52, "udp_stream": null, "frame_number": 1347, "timestamp_epoch": "1566329681.671312000" }, { "kind": "http_request", "dst_ip": "94.103.86.146", "fields": { "http.host": "hne53brianaea.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi", "http.response_in": "1678", "http.request.method": "GET", "http.request.full_uri": "http://hne53brianaea.com/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-150474af4000c74ee27642d9", "src_port": 49214, "tcp_stream": 58, "udp_stream": null, "frame_number": 1452, "timestamp_epoch": "1566329724.149645000" }, { "kind": "http_request", "dst_ip": "94.103.86.146", "fields": { "http.host": "hne53brianaea.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/favicon.ico", "http.response_in": "1685", "http.request.method": "GET", "http.request.full_uri": "http://hne53brianaea.com/favicon.ico" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-11f4fa897c778559498f5bd4", "src_port": 49214, "tcp_stream": 58, "udp_stream": null, "frame_number": 1680, "timestamp_epoch": "1566329725.102711000" }, { "kind": "http_request", "dst_ip": "94.103.86.146", "fields": { "http.host": "hne53brianaea.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi", "http.response_in": "1951", "http.request.method": "GET", "http.request.full_uri": "http://hne53brianaea.com/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-9464a5d57700b6a502bdd50a", "src_port": 49214, "tcp_stream": 58, "udp_stream": null, "frame_number": 1688, "timestamp_epoch": "1566329726.204629000" }, { "kind": "http_request", "dst_ip": "94.103.86.146", "fields": { "http.host": "hne53brianaea.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi", "http.response_in": "1957", "http.request.method": "GET", "http.request.full_uri": "http://hne53brianaea.com/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-bc612d7a8b66ee8bcf2b8991", "src_port": 49214, "tcp_stream": 58, "udp_stream": null, "frame_number": 1954, "timestamp_epoch": "1566329727.940226000" }, { "kind": "http_request", "dst_ip": "23.200.143.72", "fields": { "http.host": "www.download.windowsupdate.com", "http.user_agent": "Microsoft-CryptoAPI/6.1", "http.request.uri": "/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "http.response_in": "2082", "http.request.method": "GET", "http.request.full_uri": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-e28c943c19b23eae742113f9", "src_port": 49218, "tcp_stream": 62, "udp_stream": null, "frame_number": 2029, "timestamp_epoch": "1566329807.592332000" }, { "kind": "http_request", "dst_ip": "139.198.5.65", "fields": { "http.host": "activity.qingcloud.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/wp-content/uploads/2019/08/4antifreeze.rar", "http.response_in": "2140", "http.request.method": "GET", "http.request.full_uri": "http://activity.qingcloud.com/wp-content/uploads/2019/08/4antifreeze.rar" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-75afffc28d17657a3857c720", "src_port": 49220, "tcp_stream": 64, "udp_stream": null, "frame_number": 2138, "timestamp_epoch": "1566330099.486377000" }, { "kind": "http_request", "dst_ip": "206.189.74.47", "fields": { "http.host": "idogoiania.com.br", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/wp-content/uploads/2019/08/3antifreeze.rar", "http.response_in": "3253", "http.request.method": "GET", "http.request.full_uri": "http://idogoiania.com.br/wp-content/uploads/2019/08/3antifreeze.rar" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-c6cc04d88e82bb456e257b49", "src_port": 49228, "tcp_stream": 72, "udp_stream": null, "frame_number": 3251, "timestamp_epoch": "1566330403.397584000" }, { "kind": "http_request", "dst_ip": "185.183.98.232", "fields": { "http.host": "185.183.98.232", "http.request.uri": "/samerton.png", "http.response_in": "6851", "http.request.method": "GET", "http.request.full_uri": "http://185.183.98.232/samerton.png" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-895e0bacf6c787ad90c8a85d", "src_port": 49238, "tcp_stream": 82, "udp_stream": null, "frame_number": 6112, "timestamp_epoch": "1566330597.277074000" }, { "kind": "http_request", "dst_ip": "170.238.117.187", "fields": { "http.host": "170.238.117.187", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/", "http.response_in": "6927", "http.content_length": "271", "http.request.method": "POST", "http.request.full_uri": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/" }, "src_ip": "10.8.20.101", "dst_port": 8082, "event_id": "evt-ff7feeed1cee4564a9c9bfbe", "src_port": 49241, "tcp_stream": 85, "udp_stream": null, "body_sha256": "df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742", "frame_number": 6923, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 271, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 271, "timestamp_epoch": "1566330616.714903000" }, { "kind": "http_request", "dst_ip": "170.238.117.187", "fields": { "http.host": "170.238.117.187", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/", "http.response_in": "7743", "http.content_length": "320", "http.request.method": "POST", "http.request.full_uri": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/" }, "src_ip": "10.8.20.101", "dst_port": 8082, "event_id": "evt-40f6a105845ff9a247c6171d", "src_port": 49242, "tcp_stream": 86, "udp_stream": null, "body_sha256": "218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30", "frame_number": 7165, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 320, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 320, "timestamp_epoch": "1566330619.221754000" }, { "kind": "http_request", "dst_ip": "185.183.98.232", "fields": { "http.host": "185.183.98.232", "http.user_agent": "WinHTTP loader/1.0", "http.request.uri": "/tablone.png", "http.response_in": "8566", "http.request.method": "GET", "http.request.full_uri": "http://185.183.98.232/tablone.png" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-ebc12fb68755f80c70e354be", "src_port": 49244, "tcp_stream": 88, "udp_stream": null, "frame_number": 7765, "timestamp_epoch": "1566330622.134171000" }, { "kind": "http_request", "dst_ip": "170.238.117.187", "fields": { "http.host": "170.238.117.187", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/", "http.response_in": "7860", "http.content_length": "259", "http.request.method": "POST", "http.request.full_uri": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/" }, "src_ip": "10.8.20.101", "dst_port": 8082, "event_id": "evt-0659a1e5978015bb15152625", "src_port": 49243, "tcp_stream": 87, "udp_stream": null, "body_sha256": "351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15", "frame_number": 7772, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 259, "credential_record_present": true, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 259, "timestamp_epoch": "1566330622.260866000" }, { "kind": "http_request", "dst_ip": "170.238.117.187", "fields": { "http.host": "170.238.117.187:8082", "http.user_agent": "test", "http.request.uri": "/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90", "http.response_in": "9420", "http.content_length": "4575", "http.request.method": "POST", "http.request.full_uri": "http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90" }, "src_ip": "10.8.20.101", "dst_port": 8082, "event_id": "evt-63e7d0be16f8c5da0eb457c1", "src_port": 49511, "tcp_stream": 99, "udp_stream": null, "body_sha256": "30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844", "frame_number": 9414, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [ { "type": "hostname", "value": "Tampa-Office-PC", "source": "explicit-body-label" }, { "type": "account", "value": "reginald.chandler", "source": "explicit-body-label" } ], "inspected_bytes": 4575, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": true }, "body_size_bytes": 4575, "timestamp_epoch": "1566330633.083564000" }, { "kind": "http_request", "dst_ip": "185.183.98.232", "fields": { "http.host": "185.183.98.232", "http.request.uri": "/wredneg2.png", "http.response_in": "11294", "http.request.method": "GET", "http.request.full_uri": "http://185.183.98.232/wredneg2.png" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-5bf5a006aed7d17bd350ebd9", "src_port": 49557, "tcp_stream": 123, "udp_stream": null, "frame_number": 10374, "timestamp_epoch": "1566330655.213787000" }, { "kind": "http_request", "dst_ip": "68.183.185.221", "fields": { "http.host": "boozzdigital.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "http.request.uri": "/wp-content/uploads/2019/08/antifreeze.rar", "http.response_in": "13445", "http.request.method": "GET", "http.request.full_uri": "http://boozzdigital.com/wp-content/uploads/2019/08/antifreeze.rar" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-9aa80cdcfb1a4ec748ff25d5", "src_port": 49564, "tcp_stream": 130, "udp_stream": null, "frame_number": 12669, "timestamp_epoch": "1566330702.734890000" }, { "kind": "http_request", "dst_ip": "185.183.98.232", "fields": { "http.host": "185.183.98.232", "http.user_agent": "WinHTTP loader/1.0", "http.request.uri": "/samerton.png", "http.response_in": "17479", "http.request.method": "GET", "http.request.full_uri": "http://185.183.98.232/samerton.png" }, "src_ip": "10.8.20.101", "dst_port": 80, "event_id": "evt-f42bbe3a1aaac1c2fd011d03", "src_port": 49575, "tcp_stream": 141, "udp_stream": null, "frame_number": 16701, "timestamp_epoch": "1566330829.918742000" }, { "kind": "http_request", "dst_ip": "170.238.117.187", "fields": { "http.host": "170.238.117.187:8082", "http.user_agent": "test", "http.request.uri": "/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90", "http.response_in": "18249", "http.content_length": "2098", "http.request.method": "POST", "http.request.full_uri": "http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90" }, "src_ip": "10.8.20.101", "dst_port": 8082, "event_id": "evt-5258b0ff20f8f5409e84fccb", "src_port": 49586, "tcp_stream": 152, "udp_stream": null, "body_sha256": "5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953", "frame_number": 18243, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2098, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2098, "timestamp_epoch": "1566331165.717613000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "413", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "14" }, "src_ip": "63.239.233.90", "dst_port": 49183, "event_id": "evt-853405bc6653aaeeba381e90", "src_port": 80, "tcp_stream": 27, "udp_stream": null, "body_sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "frame_number": 415, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 14, "timestamp_epoch": "1566329455.768270000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "687", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "551936" }, "src_ip": "94.103.87.160", "dst_port": 49202, "event_id": "evt-1ba9cccdafcdde260d78e60f", "src_port": 80, "tcp_stream": 44, "udp_stream": null, "body_sha256": "4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc", "frame_number": 1230, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 551936, "timestamp_epoch": "1566329496.242564000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1331", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "404", "http.content_length": "1743" }, "src_ip": "172.217.6.174", "dst_port": 49206, "event_id": "evt-19283218838e3edbf6514b22", "src_port": 80, "tcp_stream": 50, "udp_stream": null, "body_sha256": "b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23", "frame_number": 1334, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1743, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1743, "timestamp_epoch": "1566329681.545978000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1347", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "6327" }, "src_ip": "172.217.9.132", "dst_port": 49208, "event_id": "evt-a654eca4dc7ed4f2ad0c9871", "src_port": 80, "tcp_stream": 52, "udp_stream": null, "body_sha256": "5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7", "frame_number": 1354, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6327, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 6327, "timestamp_epoch": "1566329681.691653000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1345", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3170" }, "src_ip": "172.217.9.132", "dst_port": 49207, "event_id": "evt-1365324107041420e3ebaca4", "src_port": 80, "tcp_stream": 51, "udp_stream": null, "body_sha256": "dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139", "frame_number": 1358, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3170, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3170, "timestamp_epoch": "1566329681.695896000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1452", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "94.103.86.146", "dst_port": 49214, "event_id": "evt-4e9057f5d801d7f84b7ab7a4", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1", "frame_number": 1678, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 218540, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 218540, "timestamp_epoch": "1566329725.084605000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1680", "http.content_type": "image/vnd.microsoft.icon", "http.response.code": "200", "http.content_length": "5430" }, "src_ip": "94.103.86.146", "dst_port": 49214, "event_id": "evt-614257a9c5f7e5532b6ab20a", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "frame_number": 1685, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 5430, "timestamp_epoch": "1566329725.263153000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1688", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "94.103.86.146", "dst_port": 49214, "event_id": "evt-0ae2958e769f6a5b2cf57a6b", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437", "frame_number": 1951, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 275200, "timestamp_epoch": "1566329726.954648000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "1954", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_length": "2372" }, "src_ip": "94.103.86.146", "dst_port": 49214, "event_id": "evt-2e89ae0ed8904b1018606be5", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93", "frame_number": 1957, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2372, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2372, "timestamp_epoch": "1566329728.132316000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "2029", "http.content_type": "application/vnd.ms-cab-compressed", "http.response.code": "200", "http.content_length": "58000" }, "src_ip": "23.200.143.72", "dst_port": 49218, "event_id": "evt-d4a4234e3ec2398cdbea725f", "src_port": 80, "tcp_stream": 62, "udp_stream": null, "body_sha256": "7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a", "frame_number": 2082, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 58000, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 58000, "timestamp_epoch": "1566329807.630719000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "2138", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "139.198.5.65", "dst_port": 49220, "event_id": "evt-2ece37242d0c580d1ad3bb06", "src_port": 80, "tcp_stream": 64, "udp_stream": null, "frame_number": 2140, "timestamp_epoch": "1566330099.671563000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "3251", "http.content_type": "text/html; charset=iso-8859-1", "http.response.code": "301", "http.content_length": "276" }, "src_ip": "206.189.74.47", "dst_port": 49228, "event_id": "evt-bce7d083db405dcc9e1be0cd", "src_port": 80, "tcp_stream": 72, "udp_stream": null, "body_sha256": "ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb", "frame_number": 3253, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 276, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 276, "timestamp_epoch": "1566330403.446640000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "6112", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "845312" }, "src_ip": "185.183.98.232", "dst_port": 49238, "event_id": "evt-8f036a149f4ebb65132fcc02", "src_port": 80, "tcp_stream": 82, "udp_stream": null, "body_sha256": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "frame_number": 6851, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 845312, "timestamp_epoch": "1566330600.629265000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "6923", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "170.238.117.187", "dst_port": 49241, "event_id": "evt-85a454831935ee656c628234", "src_port": 8082, "tcp_stream": 85, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 6927, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1566330617.342323000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "7165", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "170.238.117.187", "dst_port": 49242, "event_id": "evt-89c5d98d290cc2b3de57a994", "src_port": 8082, "tcp_stream": 86, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 7743, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1566330619.789679000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "7772", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "170.238.117.187", "dst_port": 49243, "event_id": "evt-a2aad1365ea0d17b54e3929b", "src_port": 8082, "tcp_stream": 87, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 7860, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1566330622.819462000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "7765", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "845312" }, "src_ip": "185.183.98.232", "dst_port": 49244, "event_id": "evt-edf76226e02775af6acde42e", "src_port": 80, "tcp_stream": 88, "udp_stream": null, "body_sha256": "9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345", "frame_number": 8566, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 845312, "timestamp_epoch": "1566330625.679780000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "9414", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "170.238.117.187", "dst_port": 49511, "event_id": "evt-b4c7ba3e5e128153f0a1a98f", "src_port": 8082, "tcp_stream": 99, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 9420, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1566330633.723877000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "10374", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "842240" }, "src_ip": "185.183.98.232", "dst_port": 49557, "event_id": "evt-817d253bd34926a6d2fb0d6b", "src_port": 80, "tcp_stream": 123, "udp_stream": null, "body_sha256": "e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224", "frame_number": 11294, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 842240, "timestamp_epoch": "1566330660.443490000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "12669", "http.content_type": "application/rar", "http.response.code": "200", "http.content_length": "753229" }, "src_ip": "68.183.185.221", "dst_port": 49564, "event_id": "evt-595112d4df36429dbd11e704", "src_port": 80, "tcp_stream": 130, "udp_stream": null, "body_sha256": "9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc", "frame_number": 13445, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 753229, "timestamp_epoch": "1566330706.025314000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "16701", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "845312" }, "src_ip": "185.183.98.232", "dst_port": 49575, "event_id": "evt-8261f40a5c192e0c6f7c1e67", "src_port": 80, "tcp_stream": 141, "udp_stream": null, "body_sha256": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "frame_number": 17479, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 845312, "timestamp_epoch": "1566330835.032932000" }, { "kind": "http_response", "dst_ip": "10.8.20.101", "fields": { "http.request_in": "18243", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "3" }, "src_ip": "170.238.117.187", "dst_port": 49586, "event_id": "evt-5955c3f07e7c4e878ffb86cf", "src_port": 8082, "tcp_stream": 152, "udp_stream": null, "body_sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "frame_number": 18249, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3, "timestamp_epoch": "1566331171.972242000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "172.217.6.133", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "gmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-ba62cab205f497ae5a1dc107", "src_port": 49209, "tcp_stream": 53, "udp_stream": null, "frame_number": 1375, "timestamp_epoch": "1566329702.734179000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.133", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "gmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-4285b6ce57db3aa0b4b422e8", "src_port": 49210, "tcp_stream": 54, "udp_stream": null, "frame_number": 1376, "timestamp_epoch": "1566329702.734255000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.9.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-50ee0d9f797be816ebc3c324", "src_port": 49211, "tcp_stream": 55, "udp_stream": null, "frame_number": 1405, "timestamp_epoch": "1566329702.918816000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.9.132", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-49eea27a0d0d723405a13370", "src_port": 49212, "tcp_stream": 56, "udp_stream": null, "frame_number": 1406, "timestamp_epoch": "1566329702.918961000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.174", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "google.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-9be033ae0b9f5a63fdbf983a", "src_port": 49215, "tcp_stream": 59, "udp_stream": null, "frame_number": 1975, "timestamp_epoch": "1566329796.463128000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.6.133", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "gmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-e36a1b7270a3c66fc334b5cb", "src_port": 49216, "tcp_stream": 60, "udp_stream": null, "frame_number": 1994, "timestamp_epoch": "1566329796.596839000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-19ce4dad0c9ff10d34e7fe72", "src_port": 49217, "tcp_stream": 61, "udp_stream": null, "frame_number": 2016, "timestamp_epoch": "1566329807.014331000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-1d3210ed6289ebc88f6d71d0", "src_port": 49219, "tcp_stream": 63, "udp_stream": null, "frame_number": 2121, "timestamp_epoch": "1566330096.772646000" }, { "kind": "tls_client_hello", "dst_ip": "139.198.5.65", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "activity.qingcloud.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-8891e49057a815035e60c291", "src_port": 49221, "tcp_stream": 65, "udp_stream": null, "frame_number": 2147, "timestamp_epoch": "1566330099.858365000" }, { "kind": "tls_client_hello", "dst_ip": "191.37.181.152", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 449, "event_id": "evt-4e1779063f4e32ef1696fb3a", "src_port": 49222, "tcp_stream": 66, "udp_stream": null, "frame_number": 2991, "timestamp_epoch": "1566330131.740930000" }, { "kind": "tls_client_hello", "dst_ip": "185.248.87.88", "fields": { "tls.handshake.ja3": "1d095e68489d3c535297cd8dffb06cb9", "tls.handshake.extensions_server_name": "api.ip.sb" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-e503e41d64a25dcbb64d6030", "src_port": 49223, "tcp_stream": 67, "udp_stream": null, "frame_number": 3006, "timestamp_epoch": "1566330133.404271000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-1ec56d2a57c426943241f2ad", "src_port": 49224, "tcp_stream": 68, "udp_stream": null, "frame_number": 3049, "timestamp_epoch": "1566330143.388957000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-0aed2b250b15faeb40dbc975", "src_port": 49226, "tcp_stream": 70, "udp_stream": null, "frame_number": 3219, "timestamp_epoch": "1566330396.793237000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-a900621aa9c3ff08cfc33d0e", "src_port": 49227, "tcp_stream": 71, "udp_stream": null, "frame_number": 3234, "timestamp_epoch": "1566330400.345365000" }, { "kind": "tls_client_hello", "dst_ip": "206.189.74.47", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "idogoiania.com.br" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-3b7c941b124bd40dd70c7a5e", "src_port": 49229, "tcp_stream": 73, "udp_stream": null, "frame_number": 3258, "timestamp_epoch": "1566330403.494827000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-4e91b52d4747479107e4b1d6", "src_port": 49230, "tcp_stream": 74, "udp_stream": null, "frame_number": 4029, "timestamp_epoch": "1566330414.450514000" }, { "kind": "tls_client_hello", "dst_ip": "185.117.75.41", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 447, "event_id": "evt-ff1ae4ab1c42b153d2f24ef4", "src_port": 49231, "tcp_stream": 75, "udp_stream": null, "frame_number": 4068, "timestamp_epoch": "1566330548.999853000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-b06db2a65349ee738af4e4a6", "src_port": 49232, "tcp_stream": 76, "udp_stream": null, "frame_number": 4099, "timestamp_epoch": "1566330549.759892000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-3058b460ba9ed98a2938bb0b", "src_port": 49233, "tcp_stream": 77, "udp_stream": null, "frame_number": 4593, "timestamp_epoch": "1566330556.689758000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-0cdda1297a5287da475d9fbd", "src_port": 49234, "tcp_stream": 78, "udp_stream": null, "frame_number": 4745, "timestamp_epoch": "1566330558.866955000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-da3094a0bc580431a0bb100d", "src_port": 49235, "tcp_stream": 79, "udp_stream": null, "frame_number": 4766, "timestamp_epoch": "1566330561.386285000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-5b1f90f020ef411ac589c1bc", "src_port": 49236, "tcp_stream": 80, "udp_stream": null, "frame_number": 4796, "timestamp_epoch": "1566330562.910490000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-48a626938acf2a9ae3d5921b", "src_port": 49237, "tcp_stream": 81, "udp_stream": null, "frame_number": 5981, "timestamp_epoch": "1566330564.474323000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-5c5e7c18cafd898725a9ab22", "src_port": 49245, "tcp_stream": 89, "udp_stream": null, "frame_number": 8347, "timestamp_epoch": "1566330625.094807000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-6c7fd8c8695237ba4a9fba9b", "src_port": 49562, "tcp_stream": 128, "udp_stream": null, "frame_number": 12444, "timestamp_epoch": "1566330700.286861000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-166f3a2c283a25104cb1d8e1", "src_port": 49567, "tcp_stream": 133, "udp_stream": null, "frame_number": 13810, "timestamp_epoch": "1566330716.398453000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-aa6e3b54b12528b447eb2475", "src_port": 49576, "tcp_stream": 142, "udp_stream": null, "frame_number": 16697, "timestamp_epoch": "1566330829.907424000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-3c4ee162787843a405514206", "src_port": 49577, "tcp_stream": 143, "udp_stream": null, "frame_number": 17514, "timestamp_epoch": "1566330958.709210000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-fdc19e4cef316d315e5e893c", "src_port": 49578, "tcp_stream": 144, "udp_stream": null, "frame_number": 17529, "timestamp_epoch": "1566331000.259793000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-096ed99b420bd8b622592f98", "src_port": 49579, "tcp_stream": 145, "udp_stream": null, "frame_number": 17544, "timestamp_epoch": "1566331002.177022000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-35c34b9d1145282634adc1b2", "src_port": 49580, "tcp_stream": 146, "udp_stream": null, "frame_number": 17563, "timestamp_epoch": "1566331014.466484000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-fc5688ce225aa8143dc44d83", "src_port": 49581, "tcp_stream": 147, "udp_stream": null, "frame_number": 17582, "timestamp_epoch": "1566331016.615305000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-6e14b57b1b0ade3b21d4a100", "src_port": 49582, "tcp_stream": 148, "udp_stream": null, "frame_number": 17648, "timestamp_epoch": "1566331160.070534000" }, { "kind": "tls_client_hello", "dst_ip": "185.117.75.41", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 447, "event_id": "evt-64da6336259bbc37f834ef62", "src_port": 49583, "tcp_stream": 149, "udp_stream": null, "frame_number": 17661, "timestamp_epoch": "1566331161.687989000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-62058762249e76cb903da4d9", "src_port": 49588, "tcp_stream": 154, "udp_stream": null, "frame_number": 18331, "timestamp_epoch": "1566331302.117270000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-5eec17f38f64b1a6df5b292d", "src_port": 49589, "tcp_stream": 155, "udp_stream": null, "frame_number": 18346, "timestamp_epoch": "1566331314.058492000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-4317c4e27b70e2a62af9ce30", "src_port": 49590, "tcp_stream": 156, "udp_stream": null, "frame_number": 18374, "timestamp_epoch": "1566331471.453731000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-247156bc099d1ddcb9274fa0", "src_port": 49591, "tcp_stream": 157, "udp_stream": null, "frame_number": 18398, "timestamp_epoch": "1566331602.113804000" }, { "kind": "tls_client_hello", "dst_ip": "185.193.141.166", "fields": { "tls.handshake.ja3": "4d7a28d6f2263ed61de88ca66eb011e3", "tls.handshake.extensions_server_name": "kjoanaxbrennan.top" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-01b8e05b189aba941235a037", "src_port": 49592, "tcp_stream": 158, "udp_stream": null, "frame_number": 18413, "timestamp_epoch": "1566331605.542730000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-81857fdbe2fccbddb42b5d5b", "src_port": 49593, "tcp_stream": 159, "udp_stream": null, "frame_number": 18432, "timestamp_epoch": "1566331673.034437000" }, { "kind": "tls_client_hello", "dst_ip": "185.117.75.41", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 447, "event_id": "evt-5310f81f1f2db494f332f591", "src_port": 49594, "tcp_stream": 160, "udp_stream": null, "frame_number": 18445, "timestamp_epoch": "1566331674.374722000" }, { "kind": "tls_client_hello", "dst_ip": "89.105.203.184", "fields": { "tls.handshake.ja3": "6734f37431670b3ab4292b8f60f29984" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-d1d54e486210f856fb3f839a", "src_port": 49595, "tcp_stream": 161, "udp_stream": null, "frame_number": 18480, "timestamp_epoch": "1566331675.906866000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49599, "event_id": "evt-4a35364d26a00f41857babc5", "src_port": 443, "tcp_stream": 165, "udp_stream": null, "frame_number": 18580, "timestamp_epoch": "1566331706.796137000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-0dd3d2cf47d6cff9c230c4c1", "src_port": 49601, "tcp_stream": 166, "udp_stream": null, "frame_number": 18581, "timestamp_epoch": "1566331706.796557000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49598, "event_id": "evt-18d1f19f5a5fc7c77d151971", "src_port": 443, "tcp_stream": 164, "udp_stream": null, "frame_number": 18620, "timestamp_epoch": "1566331707.731554000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-f278fb59ca013aa999bfa819", "src_port": 49600, "tcp_stream": 167, "udp_stream": null, "frame_number": 18621, "timestamp_epoch": "1566331707.731808000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49602, "event_id": "evt-9c13346e0dd668269e27df2b", "src_port": 443, "tcp_stream": 168, "udp_stream": null, "frame_number": 18708, "timestamp_epoch": "1566331712.707683000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-aeff547ce62f1fda499c8368", "src_port": 49604, "tcp_stream": 170, "udp_stream": null, "frame_number": 18710, "timestamp_epoch": "1566331712.707971000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49603, "event_id": "evt-c50e838325bba185fedd1b74", "src_port": 443, "tcp_stream": 169, "udp_stream": null, "frame_number": 18731, "timestamp_epoch": "1566331712.983119000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-8b01d3b7dab6f4a765ecd0d0", "src_port": 49605, "tcp_stream": 171, "udp_stream": null, "frame_number": 18732, "timestamp_epoch": "1566331712.983373000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49606, "event_id": "evt-bbac48a91e2f4ce2efcbeace", "src_port": 443, "tcp_stream": 172, "udp_stream": null, "frame_number": 18833, "timestamp_epoch": "1566331715.122500000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-5fab7aa805bec6eff9705472", "src_port": 49608, "tcp_stream": 174, "udp_stream": null, "frame_number": 18834, "timestamp_epoch": "1566331715.122670000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49607, "event_id": "evt-13833a98cc45eed2ab9cb8aa", "src_port": 443, "tcp_stream": 173, "udp_stream": null, "frame_number": 18851, "timestamp_epoch": "1566331715.355376000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-3131106d8b5b1308d12020b1", "src_port": 49609, "tcp_stream": 175, "udp_stream": null, "frame_number": 18852, "timestamp_epoch": "1566331715.355555000" }, { "kind": "tls_client_hello", "dst_ip": "10.8.20.101", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "5.39.113.142", "dst_port": 49610, "event_id": "evt-5cb6c42b2eefb75e733fd224", "src_port": 443, "tcp_stream": 176, "udp_stream": null, "frame_number": 18911, "timestamp_epoch": "1566331716.329521000" }, { "kind": "tls_client_hello", "dst_ip": "185.70.40.151", "fields": { "tls.handshake.ja3": "398430069e0a8ecfbc8db0778d658d77", "tls.handshake.extensions_server_name": "mail.protonmail.com" }, "src_ip": "10.8.20.101", "dst_port": 443, "event_id": "evt-39f6ebf7028fe5a082962c25", "src_port": 49611, "tcp_stream": 177, "udp_stream": null, "frame_number": 18912, "timestamp_epoch": "1566331716.329711000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "3432312067616c6c6f7065722e7765627369746577656c636f6d652e636f6d3a20534d545020636f6d6d616e642074696d656f7574202d20636c6f73696e6720636f6e6e656374696f6e0d0a" }, "src_ip": "192.185.170.206", "dst_port": 49208, "event_id": "evt-06a0cc111574ce60875ee932", "src_port": 26, "tcp_stream": 48, "udp_stream": null, "frame_number": 1298, "timestamp_epoch": "1566329572.334535000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-b17bd3a33c0b7eb535cd2cb7", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 1961, "timestamp_epoch": "1566329767.816956000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-10c240f0198e5a34bb5cf4ff", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 2091, "timestamp_epoch": "1566329887.813823000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-c6a8ac2a4d77c024d6968f63", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 2104, "timestamp_epoch": "1566330007.825586000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-0da1fb57c2b65c399f8f1708", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 8748, "timestamp_epoch": "1566330630.780994000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-1c5bcf8c717479e356fa148a", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 14681, "timestamp_epoch": "1566330750.790395000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-6867e282d5450a241804dcde", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 17502, "timestamp_epoch": "1566330870.801649000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-e09040a97251dac6a64dd795", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 17524, "timestamp_epoch": "1566330990.813925000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-6ca280d4fcf99f6e10d2bfad", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 17608, "timestamp_epoch": "1566331110.824898000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-649f6f40254e9aa5feced2d6", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 18313, "timestamp_epoch": "1566331272.784211000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-d0d04503b265f2e89ce2b93c", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 18363, "timestamp_epoch": "1566331396.835619000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-b34a832f902854391e791923", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 18386, "timestamp_epoch": "1566331516.830275000" }, { "kind": "unclassified_tcp", "dst_ip": "10.8.20.101", "fields": { "tcp.payload": "00" }, "src_ip": "10.8.20.8", "dst_port": 49194, "event_id": "evt-fce00dac791a37c2225963a1", "src_port": 445, "tcp_stream": 37, "udp_stream": null, "frame_number": 18425, "timestamp_epoch": "1566331636.841581000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-878467063e61316ab9bef551", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 44, "timestamp_epoch": "1566329450.033276000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-59ff53a85aa478f7acd45a88", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1566329450.033547000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f36d6b535e92d3aa9ae52d78", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 84, "timestamp_epoch": "1566329450.075055000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-65e0eab31cf903c77a81ae1f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 89, "timestamp_epoch": "1566329450.075893000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-26dc0829d95d5e9ea1b163a3", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 91, "timestamp_epoch": "1566329450.076399000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-40660ccc329b4e004254874f", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 92, "timestamp_epoch": "1566329450.076605000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5c9a089bbb1a1b313597488d", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 93, "timestamp_epoch": "1566329450.077176000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c62011a45775bd38eb8c98b7", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 95, "timestamp_epoch": "1566329450.077850000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f6914c5dd512fb47f076aca5", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 152, "timestamp_epoch": "1566329450.175912000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-dba44ab53949aedc5505362b", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 154, "timestamp_epoch": "1566329450.176176000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-493d820426d7a7bb3b520dd3", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1566329450.182377000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5150237b7f84b607381a62ea", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 174, "timestamp_epoch": "1566329450.182993000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c5a6ae2d39ff7a3d04719234", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 176, "timestamp_epoch": "1566329450.183516000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f5fb1ed324729a00ced897b9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 179, "timestamp_epoch": "1566329450.183972000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6b87b01d653bc90a4aa9beda", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1566329450.184741000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fa3c35f26086ff6e32e074e0", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 196, "timestamp_epoch": "1566329450.285218000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2f4571ad9d35c7abace9d7d1", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 198, "timestamp_epoch": "1566329450.285667000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5a902b61e44e1dcf4e035462", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 204, "timestamp_epoch": "1566329450.288233000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8a6950e8edb8049f154847a7", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 206, "timestamp_epoch": "1566329450.288915000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b197f5114fddaa1353dd4ea7", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1566329450.290352000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6ce19e89477eaa7e7ad04943", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 214, "timestamp_epoch": "1566329450.290739000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2784d673e32d25ca6372c0d9", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 215, "timestamp_epoch": "1566329450.291003000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": {}, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f0073e4dda3adb8972879879", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 216, "timestamp_epoch": "1566329450.291365000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": {}, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bd2696fde5806c9d09870815", "src_port": null, "tcp_stream": 2, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1566329450.291770000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ea707c8dfb9692f2d44c9002", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1566329450.544372000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-934dc32294d938112525f6a2", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1566329450.544615000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-57223e46ef8093bb6c10058e", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1566329450.545907000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-914dbbad310a1945a79d37e0", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1566329450.546209000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3b61e5271f56c692165b76e5", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1566329450.547251000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-744ecc43352a356f1e39a4a9", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 252, "timestamp_epoch": "1566329450.547601000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bff5b5c78cd1bf593b0d030d", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 253, "timestamp_epoch": "1566329450.547763000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-35c11df2e33aedc43d1d922a", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 254, "timestamp_epoch": "1566329450.547936000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-594a03dfc2c8ca9c5546ad5d", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 268, "timestamp_epoch": "1566329451.123567000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0d7ff08dea59553666af6a3e", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1566329451.123933000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0a5b953fcb232597d83fa6c8", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1566329451.125010000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-70edca1ae2db070cf75b69ca", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 275, "timestamp_epoch": "1566329451.125804000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9758381690e02e17ef14c157", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 290, "timestamp_epoch": "1566329451.136427000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b74dea3ed164a93c3b3de2d4", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1566329451.136758000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-54f229b986e939076de3e392", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 314, "timestamp_epoch": "1566329451.139965000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-aeef4c60985d90255e6554a0", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1566329451.140475000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-545e15994ef9112e6221dc71", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1566329451.140856000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9d96af4bc4f08f1617787e94", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 318, "timestamp_epoch": "1566329451.140990000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5a719cc25c79e3118cfcb998", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 319, "timestamp_epoch": "1566329451.141179000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-17e58e80d26a534b3f162479", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 320, "timestamp_epoch": "1566329451.141372000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-16bb1e62eec356d77c391258", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 321, "timestamp_epoch": "1566329451.141606000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ec5c46f86c516619faa97205", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1566329451.141856000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bdc9afae168d191364981ed6", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 365, "timestamp_epoch": "1566329451.153597000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5fbbfbc8a3fe0cee9f923425", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 371, "timestamp_epoch": "1566329451.535969000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b37e71467dbb37ec9e2dcccd", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1566329460.822107000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7e33d78d6de894adc6dd6f66", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1566329460.822386000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cda69b4ebe59e889457d8e52", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1566329460.823517000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e57d2493928f7e41267fffc8", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1566329460.824114000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-26ec8f55b15f89803eac4e65", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1566329460.825247000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-25a0c4b71fe83af6258f8133", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1566329460.825387000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-61d727605734e117f76470e6", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1566329460.825539000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8c55606d709fe8cd105fbd41", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 437, "timestamp_epoch": "1566329460.825694000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=BADBUNDT-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8d191ef006c41e8cf33803b1", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1566329460.825828000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-19f0713635b0653a01d7b213", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 439, "timestamp_epoch": "1566329460.826027000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6ee35eb8c9ca8ad81ec0ca4d", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1566329460.826169000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f3cbdca5346062c13db66db9", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1566329460.827022000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e03fb859622d424ae0cf807f", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1566329460.835897000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-adfeec2e25b013b185c4b86b", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1566329460.836498000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-613adcc5c27fa46dae755a6a", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1566329460.836837000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-68093dd58bb34c27b45f0990", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1566329460.836970000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fc24eec13ad818afd4ac6b4c", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1566329460.860578000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-16365fe0cc81b31bd38018d9", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1566329460.861488000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-aad75fde67d6d4b8e961f0d4", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1566329460.861792000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-77109b938daa53b78eaaa225", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1566329460.862306000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9b538b784ae40ce93fe3f78c", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 537, "timestamp_epoch": "1566329464.420238000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-264747c42cb4c284357fceb9", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 538, "timestamp_epoch": "1566329464.420508000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1471672ef12d599b7b5460ec", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 539, "timestamp_epoch": "1566329464.420682000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-87ccdcc1abea7bfc75a2ff53", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 540, "timestamp_epoch": "1566329464.421403000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dfb20c21cba0a268e7cb141b", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 541, "timestamp_epoch": "1566329464.421597000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-18dc16817f7b2236bb6597af", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 542, "timestamp_epoch": "1566329464.422033000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-353a385048def99ddff23930", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 543, "timestamp_epoch": "1566329464.422330000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-500677f5c59aa75492805dde", "src_port": null, "tcp_stream": 17, "udp_stream": null, "frame_number": 544, "timestamp_epoch": "1566329464.422606000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b911141c945e4af4871b454f", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 610, "timestamp_epoch": "1566329464.948829000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a6806e4a657efaac5c024ef8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 612, "timestamp_epoch": "1566329464.949355000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2601142ed69160a678b63828", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 613, "timestamp_epoch": "1566329464.951178000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2c8d67bc3af27e0140d56801", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 614, "timestamp_epoch": "1566329464.951840000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b3a90c16700688f0ef34632d", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 619, "timestamp_epoch": "1566329464.954888000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-948992d9aa34a123a7093802", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 621, "timestamp_epoch": "1566329464.955707000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7a0aa629873f1087ba63c281", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 622, "timestamp_epoch": "1566329464.956237000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d17e816e604812a1b5702181", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 623, "timestamp_epoch": "1566329464.956482000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-feb2dff16f8d092bebb51cb5", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1566329464.956800000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-039d0e8b037cb7b7db1b59ed", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 625, "timestamp_epoch": "1566329464.957250000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "cn=policies,cn=system,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-29814a436a6a01f28af85921", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1566329464.957446000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-945ff7f30c3076bf5bf59223", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1566329464.957927000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e2e35bc501cc0b099d33704f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 644, "timestamp_epoch": "1566329464.965366000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-60dfc8a0048391cc310ea586", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1566329465.464476000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1fd1a8910f360cd93f4b667c", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8982, "timestamp_epoch": "1566330632.479839000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5a4ef66f4bb4a7aca5c61b14", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8983, "timestamp_epoch": "1566330632.480116000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b4b773cd76d30423f2b31a7a", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8984, "timestamp_epoch": "1566330632.480319000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-07f5cf8ea91b900aa10cb4ff", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8985, "timestamp_epoch": "1566330632.481405000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-862a07ee6966d09ea041cf20", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8986, "timestamp_epoch": "1566330632.481604000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-377f8233acabdac4b1e73011", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8987, "timestamp_epoch": "1566330632.481771000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-197aa6d32148be25d42b0824", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8990, "timestamp_epoch": "1566330632.484285000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-245de3f556e07b12ef4955ac", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8991, "timestamp_epoch": "1566330632.484483000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-30d837f7063075d4bbba319b", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8992, "timestamp_epoch": "1566330632.484657000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5fc3c4f3ebc1eaa66506775e", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8993, "timestamp_epoch": "1566330632.484919000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9f67f74810840b3ccdf12eb1", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8994, "timestamp_epoch": "1566330632.485101000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3340e5c1d2152089f6897f3f", "src_port": null, "tcp_stream": 96, "udp_stream": null, "frame_number": 8995, "timestamp_epoch": "1566330632.485265000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-efb7dd91e55835d05f548961", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9003, "timestamp_epoch": "1566330632.608580000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-adb65d6deb442ef25a691d7f", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9005, "timestamp_epoch": "1566330632.608814000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2db30dd81a8fe9fa96203e8d", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9008, "timestamp_epoch": "1566330632.609641000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-23cf7270c14aa1c6b9ed5987", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9010, "timestamp_epoch": "1566330632.610263000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ea4fa0ad4610a9059fe8ac20", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9011, "timestamp_epoch": "1566330632.611386000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b917c84cb3832c300fa70813", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9012, "timestamp_epoch": "1566330632.611554000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1ad56cf12dccd01782a6fae8", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9013, "timestamp_epoch": "1566330632.614231000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1543c17c52c14a1437e168ba", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9014, "timestamp_epoch": "1566330632.615018000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cab1f082bdbfdac928d9c5fe", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9015, "timestamp_epoch": "1566330632.615715000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-15f84733e57c98ebd1d2f73c", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9016, "timestamp_epoch": "1566330632.616319000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c3ed78d328ed62bcef456c32", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9017, "timestamp_epoch": "1566330632.616504000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-89b01299ad617a87abfae084", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9213, "timestamp_epoch": "1566330632.646869000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-56428e33f98bf20640eb5086", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9226, "timestamp_epoch": "1566330632.701015000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1da3d28b4330c8530f90be36", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9228, "timestamp_epoch": "1566330632.701634000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a35ac28a4aeb8a01d646e466", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9231, "timestamp_epoch": "1566330632.702310000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ac549f3ee5803bd1b1730bb8", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9233, "timestamp_epoch": "1566330632.703184000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ba4f08ef5a841a8ec6001ec3", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9234, "timestamp_epoch": "1566330632.703648000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f98a6832bd1e8bebeda27b48", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9235, "timestamp_epoch": "1566330632.703821000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fbbf6bf879ffaca0412c434f", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9236, "timestamp_epoch": "1566330632.704076000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4501d0f519a2e66c8c326d03", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9237, "timestamp_epoch": "1566330632.704292000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7cff042a3039e8806c324b90", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9238, "timestamp_epoch": "1566330632.704580000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-786e48d1acd8929a09e1569d", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9239, "timestamp_epoch": "1566330632.704741000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-96a0853c0f9e4af4fd3c52fc", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9240, "timestamp_epoch": "1566330632.704951000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2949f4e0f39d7875b23b6402", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9241, "timestamp_epoch": "1566330632.706995000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-60f7042ea1ac8b46d3297824", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9242, "timestamp_epoch": "1566330632.709048000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f668dda7a32b180be55236ae", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9243, "timestamp_epoch": "1566330632.710742000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4bdaa5118dd90bba16d45968", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9244, "timestamp_epoch": "1566330632.711170000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1fcd63218336fb50d1989728", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9245, "timestamp_epoch": "1566330632.711310000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bb7026f91fca632e00ede462", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9246, "timestamp_epoch": "1566330632.711475000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b178c35e17a9710c3c9279fd", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9247, "timestamp_epoch": "1566330632.711632000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-896cfecb9e0b0a6a3b2c5035", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9248, "timestamp_epoch": "1566330632.711818000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-382609378a9d193574800e02", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9249, "timestamp_epoch": "1566330632.712205000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1dcb604aa76f880125e2ba3d", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9250, "timestamp_epoch": "1566330632.712602000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a7afad86bef7172aca234452", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9251, "timestamp_epoch": "1566330632.712833000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3cffca178f71e784e78a7211", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9252, "timestamp_epoch": "1566330632.713194000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2dce17bf41d2f582ec8ecb77", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9253, "timestamp_epoch": "1566330632.713399000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e0bdab2fa059d08b04578ed7", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9254, "timestamp_epoch": "1566330632.713608000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2e6032a9c984fe0556393bd6", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9255, "timestamp_epoch": "1566330632.713817000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6ea5684efc7b8dd47fb44aee", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9256, "timestamp_epoch": "1566330632.714215000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9e54abd835bf2aef59a9c262", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9257, "timestamp_epoch": "1566330632.714602000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3fe2f6bba9b88d54ebe3f6fa", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9258, "timestamp_epoch": "1566330632.714994000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2f3a89653ed9ba8c8723d518", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9259, "timestamp_epoch": "1566330632.715242000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-725b68c55ca73d4e35211b87", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9260, "timestamp_epoch": "1566330632.715418000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-aecc7d655206b9d7f8c556ee", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9261, "timestamp_epoch": "1566330632.715535000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f786d9aebc8d3f4076a86212", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9262, "timestamp_epoch": "1566330632.715688000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a03ef753d7451e03a593eedc", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9263, "timestamp_epoch": "1566330632.715834000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-80d114a0ef77362c1d68faa5", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9264, "timestamp_epoch": "1566330632.716007000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-33013bf04e29eba100981789", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9265, "timestamp_epoch": "1566330632.716351000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3934dd2a2f43571eaf5dba14", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9266, "timestamp_epoch": "1566330632.716717000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8f32d8f310778fce93c33832", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9267, "timestamp_epoch": "1566330632.716932000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fe340e8ba2f420cdabfbc540", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9268, "timestamp_epoch": "1566330632.717341000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-926cda7dbd6bc9eba555665b", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9269, "timestamp_epoch": "1566330632.717523000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0b74d1ea1a757a254ca5cccb", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9270, "timestamp_epoch": "1566330632.717722000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c187934350c7f8aa4743ae0f", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9271, "timestamp_epoch": "1566330632.717964000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fd7852cf4d4cdd6bc175d3e9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9272, "timestamp_epoch": "1566330632.718660000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-361624343e99946d2ecaccf4", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9273, "timestamp_epoch": "1566330632.719313000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ed04a9c45719e9f352a9699d", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9274, "timestamp_epoch": "1566330632.719759000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fbb7cfe21dc6e9e1c58deb11", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9275, "timestamp_epoch": "1566330632.720008000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4e91bc437e90ca95e79ebd0c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9276, "timestamp_epoch": "1566330632.720206000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7da0f2da5740bc84e95edd45", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9277, "timestamp_epoch": "1566330632.720352000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-827b205d121333f14f40d550", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9278, "timestamp_epoch": "1566330632.720523000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8dd64a3bd2fa808b47a72917", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9279, "timestamp_epoch": "1566330632.720730000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-aedca4232fe87cd657a24396", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9280, "timestamp_epoch": "1566330632.720907000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-68a4bce5b844608f0aed406c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9281, "timestamp_epoch": "1566330632.721286000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-780a108b74f043304e2d6eb5", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9282, "timestamp_epoch": "1566330632.721748000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ae43d6d50de96cca6dc42362", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9283, "timestamp_epoch": "1566330632.721979000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ccc081cb6752cebeb69a8aff", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9284, "timestamp_epoch": "1566330632.722147000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-86490b237764c31cff4d8317", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9285, "timestamp_epoch": "1566330632.722275000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f52ac1c5fa1a1bef7c1ca94e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9286, "timestamp_epoch": "1566330632.722415000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-548b574ed928d5374a31cbee", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9287, "timestamp_epoch": "1566330632.722558000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-693e06f6ffdd8df2b4736f83", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9288, "timestamp_epoch": "1566330632.722737000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f37a85ec80a37e0fbb19e7b9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9289, "timestamp_epoch": "1566330632.723050000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-835693f7087dd50245dfe7a8", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9290, "timestamp_epoch": "1566330632.723404000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ce64b77bd05d19d232f9b9ef", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9291, "timestamp_epoch": "1566330632.723615000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a263e1a02b49510edb8bbe0a", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9292, "timestamp_epoch": "1566330632.723783000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f13119725442355768f358d6", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9293, "timestamp_epoch": "1566330632.723899000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-acc3dd3c9526b43515e56272", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9294, "timestamp_epoch": "1566330632.724044000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4e17a679937ac5395b742dae", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9295, "timestamp_epoch": "1566330632.724203000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0cf0a113e7ddff2a58670806", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9296, "timestamp_epoch": "1566330632.724362000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b51ecdffa1df56d1398ddec0", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9297, "timestamp_epoch": "1566330632.724728000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5d28089f09c2da62d2eb5337", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9298, "timestamp_epoch": "1566330632.725090000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e451ad888bea3fc2b992b9df", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9299, "timestamp_epoch": "1566330632.725306000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4123de34261380a12d93a079", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9300, "timestamp_epoch": "1566330632.725462000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a3c138768ce2c84aa9632851", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9301, "timestamp_epoch": "1566330632.725581000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0e26acaa3785449a9b0a0ad0", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9302, "timestamp_epoch": "1566330632.725717000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-68436edc42ab160fae92be45", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9303, "timestamp_epoch": "1566330632.725872000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f99f0aa811e5ccdc47853d64", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9304, "timestamp_epoch": "1566330632.726025000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8f9b6cd059ee7fa13bd2c07d", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9305, "timestamp_epoch": "1566330632.726359000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2eae8e24ded776832c4ab414", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9306, "timestamp_epoch": "1566330632.726682000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5f0aff92157a8cdbca620fd9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9307, "timestamp_epoch": "1566330632.726898000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-64b9bd2f38ada53b399906d7", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9308, "timestamp_epoch": "1566330632.727108000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a25f3e938bf71d3c0f7ac5da", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9309, "timestamp_epoch": "1566330632.727222000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-28cccbfa6da1df95a3a878c4", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9310, "timestamp_epoch": "1566330632.727364000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-526385289d879c443f672bbe", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9311, "timestamp_epoch": "1566330632.727501000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c30e3de383066d3212e46e23", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9312, "timestamp_epoch": "1566330632.727667000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-84640d4bc6d8cae3100fbe76", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9313, "timestamp_epoch": "1566330632.727966000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f6a1ebfa421b36b40da1c5f5", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9314, "timestamp_epoch": "1566330632.728317000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5067300b253a8efa3c0d757e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9315, "timestamp_epoch": "1566330632.728524000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dc26ee40f55a3cdd6347462c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9316, "timestamp_epoch": "1566330632.728696000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-41f1bb904acd9525787db7de", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9317, "timestamp_epoch": "1566330632.728811000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-77cb6161882e2645e1dc3f8c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9318, "timestamp_epoch": "1566330632.728946000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a62fad3b5bf99927c6960c96", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9319, "timestamp_epoch": "1566330632.729130000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1f97d5cc6b1d3bd8c502fbcc", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9320, "timestamp_epoch": "1566330632.729333000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-58abf7ec930bdcac1574d6ff", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9321, "timestamp_epoch": "1566330632.729664000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c914034171d3b138b58d1cc9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9322, "timestamp_epoch": "1566330632.730025000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4eb43a7dd1da8b184c27806e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9323, "timestamp_epoch": "1566330632.730234000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-10eaf1a5b2627974ad2d813b", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9324, "timestamp_epoch": "1566330632.730402000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-74eac2981c4046bee78877f6", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9325, "timestamp_epoch": "1566330632.730503000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1b439d370aea0ca5d07eac6e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9326, "timestamp_epoch": "1566330632.730661000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8c80d942cb1627175701862c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9327, "timestamp_epoch": "1566330632.730800000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e4ebd78fbd64bb94091ac5ee", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9328, "timestamp_epoch": "1566330632.730968000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-738acb8edbf288b9c8a6b1e1", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9329, "timestamp_epoch": "1566330632.731271000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-916ef59a9edf0e3c3254c999", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9330, "timestamp_epoch": "1566330632.731610000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-260c4534926e150bed8710c3", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9331, "timestamp_epoch": "1566330632.731812000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-82c5f06612ed31a1cb966550", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9332, "timestamp_epoch": "1566330632.731964000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8fd3d74f745249bce6265e5f", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9333, "timestamp_epoch": "1566330632.732077000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3bb423088254656d489325fd", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9334, "timestamp_epoch": "1566330632.732218000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-70554a93c6e93b6aff35e08d", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9335, "timestamp_epoch": "1566330632.732353000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2380d6385efa91b73f204a84", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9336, "timestamp_epoch": "1566330632.732516000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-80765715f464976c2525a715", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9337, "timestamp_epoch": "1566330632.732812000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c01d8504f55fbee1c3ca2f7c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9338, "timestamp_epoch": "1566330632.733145000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f35c623720d70a4b82ebd685", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9339, "timestamp_epoch": "1566330632.733341000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bd04d2cc9303b695edcc26d4", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9340, "timestamp_epoch": "1566330632.733498000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-122768868981fb8ec08c6411", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9341, "timestamp_epoch": "1566330632.733613000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-010c039ec80e7291ccffc41c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9342, "timestamp_epoch": "1566330632.733765000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ad6d77bd2750b60081da7a81", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9343, "timestamp_epoch": "1566330632.733946000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e4bcdf4542934c1b26e2d583", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9344, "timestamp_epoch": "1566330632.734112000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-abb3d9efcd752a2378dbff87", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9345, "timestamp_epoch": "1566330632.734440000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-74a24f9d7070deec96758587", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9346, "timestamp_epoch": "1566330632.734892000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-34467ccea78395cceaa5d116", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9347, "timestamp_epoch": "1566330632.735296000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8443d00d5b56c140e78b303a", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9348, "timestamp_epoch": "1566330632.735569000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5d0a302eb73fa0c618c44e15", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9349, "timestamp_epoch": "1566330632.735719000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c0c29942c32cee5d65e952ca", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9350, "timestamp_epoch": "1566330632.735882000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-315f652b8ec69035aa3e78ca", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9351, "timestamp_epoch": "1566330632.736053000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-35a1cf2b2dd47f43ea89867b", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9352, "timestamp_epoch": "1566330632.736224000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e02fa63921afd95f5cd841fb", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9353, "timestamp_epoch": "1566330632.736559000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4d74285ad61406775acef089", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9354, "timestamp_epoch": "1566330632.736912000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-af35e99f58797414b60cba65", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9355, "timestamp_epoch": "1566330632.737169000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ae9757b21d11b502f65f1994", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9356, "timestamp_epoch": "1566330632.737359000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b24ffe0d3822d1882e51c843", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9357, "timestamp_epoch": "1566330632.737527000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-84a891df9165f8e7ce90b53a", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9358, "timestamp_epoch": "1566330632.737765000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-77a486a354ff3fe4f3347c02", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9359, "timestamp_epoch": "1566330632.737941000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c9402afca26eddf37fda9b1c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9360, "timestamp_epoch": "1566330632.738121000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6f136b4edcb3c0805f16ea00", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9361, "timestamp_epoch": "1566330632.738455000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-86813a0ee5cd4aac0a69e1f6", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9362, "timestamp_epoch": "1566330632.738829000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7a2b1da7ffc5e39036514a8e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9363, "timestamp_epoch": "1566330632.739043000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ab1746928116b3036283a87a", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9364, "timestamp_epoch": "1566330632.739204000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9d76483a6b01a221c245ca71", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9365, "timestamp_epoch": "1566330632.739317000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-61d955ec1942f9240da78cc4", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9366, "timestamp_epoch": "1566330632.739453000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e54a02b0635ed0d1a75001d1", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9367, "timestamp_epoch": "1566330632.739589000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-542ff3a491c370f6464ba77f", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9368, "timestamp_epoch": "1566330632.739761000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-233dc561ad160d15bb2609d2", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9369, "timestamp_epoch": "1566330632.740062000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-394d1878af0a8177d6b657ad", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9370, "timestamp_epoch": "1566330632.740410000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-947e407800b3e4bef3709967", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9371, "timestamp_epoch": "1566330632.740630000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-35a65f9efbc7865145d0b06f", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9372, "timestamp_epoch": "1566330632.740788000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e3d5b9b19ad550b88cf33d6a", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9373, "timestamp_epoch": "1566330632.740910000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e8cf5fef8a573bc1d32994d9", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9374, "timestamp_epoch": "1566330632.741043000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4107fd2d38af4ba5fd5de289", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9375, "timestamp_epoch": "1566330632.741192000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a2f6e73527f4653eafa1f9a3", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9376, "timestamp_epoch": "1566330632.741347000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d684162e3f52d042d297d92c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9377, "timestamp_epoch": "1566330632.741655000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-08287bd748c8f1867a208299", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9378, "timestamp_epoch": "1566330632.741998000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-659378fa385b7127c5a8ed80", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9379, "timestamp_epoch": "1566330632.742295000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b55ebcf3196634a0ddfcae3c", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9380, "timestamp_epoch": "1566330632.742546000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-14e7a542bf5ec668caaed7e5", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9381, "timestamp_epoch": "1566330632.742669000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e1a6ebcf7edf54a993c37b5e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9382, "timestamp_epoch": "1566330632.742814000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-728610e2e6df6d94a76506a5", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9383, "timestamp_epoch": "1566330632.742970000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a5bd51eb3ef23f3026b151c2", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9384, "timestamp_epoch": "1566330632.743144000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0afca9cc2096a670bf608230", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9385, "timestamp_epoch": "1566330632.743448000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1e66870f4a9828317b791073", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9386, "timestamp_epoch": "1566330632.743809000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-da9e92b08099f88990e3323e", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9387, "timestamp_epoch": "1566330632.744029000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-28580611c3c650964c85fc58", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9388, "timestamp_epoch": "1566330632.744186000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-034494597d25c36a7a11cbd8", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9389, "timestamp_epoch": "1566330632.744299000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1bbe2ed329d2197dcc807caa", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9390, "timestamp_epoch": "1566330632.744610000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c073494197372501ddca66e1", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9391, "timestamp_epoch": "1566330632.744763000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-213a23ea83e94a9b2037f279", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9392, "timestamp_epoch": "1566330632.744941000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-01f17578a2a8c1600f3ea668", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9393, "timestamp_epoch": "1566330632.745274000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9ac7ad1c0ab448d7f11d57f3", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9394, "timestamp_epoch": "1566330632.745870000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d237b6f7c67f935d78df46f3", "src_port": null, "tcp_stream": 98, "udp_stream": null, "frame_number": 9395, "timestamp_epoch": "1566330632.746126000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-32c2b6e09f38c9c1f83bd1f1", "src_port": null, "tcp_stream": 97, "udp_stream": null, "frame_number": 9396, "timestamp_epoch": "1566330632.746328000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-de6dea3a1a1ed7150c04d92a", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10010, "timestamp_epoch": "1566330654.944775000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-578e3dea00b9073b84efd5f8", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10012, "timestamp_epoch": "1566330654.944989000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-57dcaab6ccaf3417b24c14c8", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10015, "timestamp_epoch": "1566330654.945945000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-df45a70a0e015ea753c9cb84", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10017, "timestamp_epoch": "1566330654.946507000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8a8fd6dc6db96ea176dcf5fe", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10018, "timestamp_epoch": "1566330654.948150000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b5ed7156b401676cba2027ae", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10019, "timestamp_epoch": "1566330654.948298000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bd641beb40f5b336080c87cb", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10020, "timestamp_epoch": "1566330654.949209000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-82533a6788a71dc9cfc51a68", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10021, "timestamp_epoch": "1566330654.950225000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-48acde66c53d9ceb5e7d9ba7", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10022, "timestamp_epoch": "1566330654.950487000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bef078101aab423904490d44", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10023, "timestamp_epoch": "1566330654.951290000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "3", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ef62d584e3b5e7e90003a8d8", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10024, "timestamp_epoch": "1566330654.974686000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5cb62e8a65be29fb4c197e4d", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10025, "timestamp_epoch": "1566330654.975533000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-31fca5429175fdeebc7d032c", "src_port": null, "tcp_stream": 100, "udp_stream": null, "frame_number": 10359, "timestamp_epoch": "1566330655.005393000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-714af23b6ce203fcd7f1b139", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17700, "timestamp_epoch": "1566331164.599814000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1bd9bdcc24cb7937bf38f2ae", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17702, "timestamp_epoch": "1566331164.600061000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-db34e0da2e1cdeac04db6dc3", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17705, "timestamp_epoch": "1566331164.601015000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1db7145b659354230fa8c41e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17707, "timestamp_epoch": "1566331164.601772000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e7ff72badb157a43b39b7c0d", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17708, "timestamp_epoch": "1566331164.603431000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0c025eec16f38258ab238b63", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17709, "timestamp_epoch": "1566331164.603674000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-266e898fd3d60c213f067d88", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17710, "timestamp_epoch": "1566331164.604489000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-16527ceb5c35a2ac66f993ea", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17711, "timestamp_epoch": "1566331164.605594000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-967d9721330fa26585aaac9a", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17712, "timestamp_epoch": "1566331164.606533000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7cfcf9fea351fb0f495babed", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17713, "timestamp_epoch": "1566331164.606884000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3fb97a3e9bea395b0c2ae1df", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17714, "timestamp_epoch": "1566331164.608027000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f70c49a7461151f9d3f2ada9", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17715, "timestamp_epoch": "1566331164.608463000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-44d48451e7ba6c4aeb69a00a", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17716, "timestamp_epoch": "1566331164.609824000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3aab6ac18fdaa7fa512b6814", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17717, "timestamp_epoch": "1566331164.610084000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c75ba7461f2df2db9c0ab003", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17718, "timestamp_epoch": "1566331164.610964000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a2bfaf98658708743428a5cf", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17719, "timestamp_epoch": "1566331164.611391000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c83190d66124931e89dba2f4", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17720, "timestamp_epoch": "1566331164.612256000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d4e321f31ad5fbef9986a885", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17721, "timestamp_epoch": "1566331164.612664000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a8ddcfc5c6fdc41e09ce1d0e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17722, "timestamp_epoch": "1566331164.613517000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-47a3a5b2d2c736a4883b59b7", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17723, "timestamp_epoch": "1566331164.613786000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5aee01a9f935604381a9fa72", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17724, "timestamp_epoch": "1566331164.614576000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a1cb954302f11b0d30cc9b79", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17725, "timestamp_epoch": "1566331164.614824000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8c4ed5514d6aa4eff3e1ad08", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17726, "timestamp_epoch": "1566331164.615430000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e1f329a1c5bbee7ea3c3e12c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17727, "timestamp_epoch": "1566331164.615639000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0324d04a8242e669a76ec0c5", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17728, "timestamp_epoch": "1566331164.616257000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-eb76482f89834db6ea58d670", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17729, "timestamp_epoch": "1566331164.616473000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-285f88f6a7cdfd19f5fa6af1", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17730, "timestamp_epoch": "1566331164.616983000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1b6657444d28304007b6bdc1", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17731, "timestamp_epoch": "1566331164.618382000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a27f9fc27cb6bff74462ca7a", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17732, "timestamp_epoch": "1566331164.620268000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6ed5ef9437fa69b4d59cabcc", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17733, "timestamp_epoch": "1566331164.620700000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8024959e55e31b5bd65f774d", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17734, "timestamp_epoch": "1566331164.621300000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-92a6a6600a0870014e3663c9", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17735, "timestamp_epoch": "1566331164.621553000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c0b5c7374a18de858555c981", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17736, "timestamp_epoch": "1566331164.622325000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-55c9b21508745c65ddd1231d", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17737, "timestamp_epoch": "1566331164.622632000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2dd4b844934472bcd57a9bdd", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17738, "timestamp_epoch": "1566331164.623419000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4ce81f8ec3a4f59b098b0b17", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17739, "timestamp_epoch": "1566331164.623699000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b75f8dbc74f4e70cca107e99", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17740, "timestamp_epoch": "1566331164.624372000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6925fc0fe86efe72d1c2eb4e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17741, "timestamp_epoch": "1566331164.624810000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-23098a23ab9fb89978b1e19c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17742, "timestamp_epoch": "1566331164.625745000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f65f1f8f4ed26cb0555c5f4b", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17743, "timestamp_epoch": "1566331164.626167000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b2b3c4f10c41a2542f951784", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17744, "timestamp_epoch": "1566331164.627047000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ced11c54cbf2be3116759b58", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17745, "timestamp_epoch": "1566331164.627355000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a3f6a9823902db463815b0b8", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17746, "timestamp_epoch": "1566331164.627947000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c5b88511e851158cd1019532", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17747, "timestamp_epoch": "1566331164.628276000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2e3f67b5ba02045e9d2c0f87", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17748, "timestamp_epoch": "1566331164.628817000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8245f34b4080f7379bac0068", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17749, "timestamp_epoch": "1566331164.629076000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-198a1bdcb06f8725daf6b7eb", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17750, "timestamp_epoch": "1566331164.629778000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2b3d816d753d6f27ff36bde1", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17751, "timestamp_epoch": "1566331164.634371000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0994bcc113a1cbcaf954e79e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17752, "timestamp_epoch": "1566331164.635372000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f761a43a8e6779668f206fef", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17753, "timestamp_epoch": "1566331164.635830000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-616f5a091ad31988d4523a43", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17754, "timestamp_epoch": "1566331164.636504000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-35196ccc4feb39fe3eb52b90", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17755, "timestamp_epoch": "1566331164.636894000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-342379b016f042ed7f98c033", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17756, "timestamp_epoch": "1566331164.637789000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-410750399155878a61978f89", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17757, "timestamp_epoch": "1566331164.638173000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4aa30bc7aa527e7fc85308f2", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17758, "timestamp_epoch": "1566331164.639098000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-54368216795848b323d30ff2", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17759, "timestamp_epoch": "1566331164.639513000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0b4dccafb74c95699d850f60", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17760, "timestamp_epoch": "1566331164.640548000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0560c844f1bff9e8deeae52e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17761, "timestamp_epoch": "1566331164.640958000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-40dadfcf3ad67006695a6ffc", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17762, "timestamp_epoch": "1566331164.642200000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-13d1b072731cdaede8563d65", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17763, "timestamp_epoch": "1566331164.642666000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-110be3d3f204d13c692ae43e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17764, "timestamp_epoch": "1566331164.643749000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-700852b02214ceb0daf087b6", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17765, "timestamp_epoch": "1566331164.644156000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a866fb33057b210a3cfec0e8", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17766, "timestamp_epoch": "1566331164.645199000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-23e43ce201da78dbc01ecfcb", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17767, "timestamp_epoch": "1566331164.645582000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-72cb538ae36a55fd8915b01c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17768, "timestamp_epoch": "1566331164.646644000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f23cfe3637d0497722cfc801", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17769, "timestamp_epoch": "1566331164.647106000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-499216f6406f85b7c8cc837c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17770, "timestamp_epoch": "1566331164.648125000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8ad6f7dc0096705c8342d65e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17771, "timestamp_epoch": "1566331164.648309000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-84de8b7c08ac1842e22bd042", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17772, "timestamp_epoch": "1566331164.649337000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a31aa2edfeb70b2947ca8f33", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17773, "timestamp_epoch": "1566331164.649560000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e901abfc2ad7d8b8593588ae", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17774, "timestamp_epoch": "1566331164.650627000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-21a4c5bfe71857a1a3bd74de", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17775, "timestamp_epoch": "1566331164.650854000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-80d8c14546ec87591e7343ec", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17776, "timestamp_epoch": "1566331164.652807000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2d1c32b79d7af382571b1e43", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17777, "timestamp_epoch": "1566331164.653075000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-beec1963faf67a644f22bbdd", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17778, "timestamp_epoch": "1566331164.654012000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7f3cca729f8c160b1ca59770", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17779, "timestamp_epoch": "1566331164.654206000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-44d2faa9381639cc2c0ae85a", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17780, "timestamp_epoch": "1566331164.655156000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ba129783b20370174b8dae43", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17781, "timestamp_epoch": "1566331164.655346000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9499d5577f9fc57afb5c3e4e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17782, "timestamp_epoch": "1566331164.656282000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0befac468c941a87d972a7e1", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17783, "timestamp_epoch": "1566331164.656492000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8f2f11b8c8f3c5585f7ff796", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17784, "timestamp_epoch": "1566331164.657779000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2725653502a5fe8cd645cec3", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17785, "timestamp_epoch": "1566331164.658170000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8433ac702793dbd35a81fe56", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17786, "timestamp_epoch": "1566331164.659511000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-89dfd0ba9eb72f3560e68d2c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17787, "timestamp_epoch": "1566331164.659792000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-06505bfae046f77b4bf74d05", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17788, "timestamp_epoch": "1566331164.661226000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8c98e469a18ac8edf1cb29b5", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17789, "timestamp_epoch": "1566331164.661476000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1d338e6659ebcdd8026c7571", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17790, "timestamp_epoch": "1566331164.662641000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d129fe3b1f5f626c68540701", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17791, "timestamp_epoch": "1566331164.663090000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8f1002938ceaeade610891b1", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17792, "timestamp_epoch": "1566331164.664062000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-11ddb7afeae7906462ad7bca", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17793, "timestamp_epoch": "1566331164.664367000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-eba63438afefdc9fd511c9b2", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17794, "timestamp_epoch": "1566331164.665500000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fd3312831a6558475046aca4", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17795, "timestamp_epoch": "1566331164.665819000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7ca99f9d5212292e75f00696", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17796, "timestamp_epoch": "1566331164.666989000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-20d9b2e8cf0d9c7f48de809c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17797, "timestamp_epoch": "1566331164.667237000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-894c6caf9a1d2580fc827fef", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17798, "timestamp_epoch": "1566331164.668544000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7cf77f20cf4e7aa73cdc725e", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17799, "timestamp_epoch": "1566331164.668808000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4aacc9263fbdd09e026151ad", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17800, "timestamp_epoch": "1566331164.669705000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-aa1bbd81466ca1e2182ff597", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17801, "timestamp_epoch": "1566331164.669907000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4b34f490e4601111239e2ffe", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17802, "timestamp_epoch": "1566331164.670707000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-98f67f409ac9387faa4cde91", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17803, "timestamp_epoch": "1566331164.670889000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7d4e2afd561912dce17d5f74", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17804, "timestamp_epoch": "1566331164.671709000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2ff672cd008103b973be7b8c", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17805, "timestamp_epoch": "1566331164.671940000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1a083d7a7ea5490727bb4005", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17806, "timestamp_epoch": "1566331164.673021000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-441af69d124839888ecbfc8f", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17807, "timestamp_epoch": "1566331164.673469000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9ed6de09bbdb87e4514e0d2a", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17808, "timestamp_epoch": "1566331164.674710000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-065de796eccf45ad083ec3eb", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17809, "timestamp_epoch": "1566331164.674934000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-521bce97ba35189ad59bba98", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17810, "timestamp_epoch": "1566331164.675133000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ca5f8e154f084087cdb220f3", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17811, "timestamp_epoch": "1566331164.675639000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Aggregate,CN=Schema,CN=Configuration,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-28f035cbd0a642359796e3c5", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17812, "timestamp_epoch": "1566331164.676080000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-63428f3e4b24af5737e65ba2", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 17813, "timestamp_epoch": "1566331164.676608000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-74e262cac12f786964639fb9", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17817, "timestamp_epoch": "1566331164.704613000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-df827df7f9096bfd5f972099", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17819, "timestamp_epoch": "1566331164.704803000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-98fd79af3aa25c34c5bb2c0b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17822, "timestamp_epoch": "1566331164.705824000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2d7d56f0d9b1d2a184902946", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17824, "timestamp_epoch": "1566331164.706368000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0aac049a06f9357a53542afe", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17825, "timestamp_epoch": "1566331164.706751000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-32f35638ea6960d0cc117247", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17826, "timestamp_epoch": "1566331164.706890000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fc6ac222de3db603640aa5fd", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17827, "timestamp_epoch": "1566331164.707058000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b5cfd0fcd15f5fc2b3bb6360", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17828, "timestamp_epoch": "1566331164.707260000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-941004136b38646b32ceca66", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17829, "timestamp_epoch": "1566331164.707462000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b482385828b68ba57d43c8a0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17830, "timestamp_epoch": "1566331164.707589000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b7e3838fb30bee4dd8e21bbb", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17831, "timestamp_epoch": "1566331164.707785000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-98f048dc2d75d435e085f98f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17832, "timestamp_epoch": "1566331164.709646000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-450b431b34bf4d7877f792b5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17833, "timestamp_epoch": "1566331164.710316000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7501fb72c495671b4072cdf5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17834, "timestamp_epoch": "1566331164.711515000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a0231addef0574d054fd3f28", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17835, "timestamp_epoch": "1566331164.711703000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9410f361d68cb58ea88d0ad5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17836, "timestamp_epoch": "1566331164.711852000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-aeccc6a9882a1c3c678b7001", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17837, "timestamp_epoch": "1566331164.712015000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9866df378ea2dc3e8a60a129", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17838, "timestamp_epoch": "1566331164.712191000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2450ef60ce7ee25d4a0c29bd", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17839, "timestamp_epoch": "1566331164.712366000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e312985afbca85a6234b116c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17840, "timestamp_epoch": "1566331164.712770000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-138b49b0ea652a786547d7aa", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17841, "timestamp_epoch": "1566331164.713320000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-20421ed5d1cdef552d1b0dc5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17842, "timestamp_epoch": "1566331164.713536000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1ec0ced0bbf546bf65e516a6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17843, "timestamp_epoch": "1566331164.713734000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-11e80ba0965fee89b4ed652c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17844, "timestamp_epoch": "1566331164.713858000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-722be5e310d77a6095e401a5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17845, "timestamp_epoch": "1566331164.714002000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-eecdb63bd1ca48a2f7734d48", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17846, "timestamp_epoch": "1566331164.714144000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b7dbbad47e8fc84befea553c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17847, "timestamp_epoch": "1566331164.714309000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d43cc25b89d0a2cbb697fe93", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17848, "timestamp_epoch": "1566331164.714578000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b1ca2dcb86f890a7eee5dfa5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17849, "timestamp_epoch": "1566331164.714929000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7190b2a00fd6552e940bbb39", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17850, "timestamp_epoch": "1566331164.715111000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-65ca7644abd3dbbc8053c4e5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17851, "timestamp_epoch": "1566331164.715303000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c94bd9e112fd118aa750f122", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17852, "timestamp_epoch": "1566331164.715421000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d588694a763d58a3b0b14288", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17853, "timestamp_epoch": "1566331164.715562000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fdc04bf96954927646aa4342", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17854, "timestamp_epoch": "1566331164.715701000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9d48d8e4a92adaec4a2bba08", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17855, "timestamp_epoch": "1566331164.715864000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-267168e9fe1362da83276856", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17856, "timestamp_epoch": "1566331164.716135000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-48c340ae80e5b3f154b30992", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17857, "timestamp_epoch": "1566331164.716495000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e952c83b78ac8fc9c0100af3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17858, "timestamp_epoch": "1566331164.716669000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-50a5b7be6792b76b9c143f60", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17859, "timestamp_epoch": "1566331164.716860000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cc0c5ca42ac677e06d95531c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17860, "timestamp_epoch": "1566331164.716977000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b07f90190911a5efd799137d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17861, "timestamp_epoch": "1566331164.717139000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a9eaa82c57d66a51205f74de", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17862, "timestamp_epoch": "1566331164.717289000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fb579f47270753b822ac5b00", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17863, "timestamp_epoch": "1566331164.717520000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2df02dcf549e826a097fb033", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17864, "timestamp_epoch": "1566331164.717935000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1323c864d507f0d3e12e2d40", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17865, "timestamp_epoch": "1566331164.718376000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bcfcf28d41decf9ea5ce3a98", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17866, "timestamp_epoch": "1566331164.718594000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1ff44b169d0c905d37615bbf", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17867, "timestamp_epoch": "1566331164.718806000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fb6c8ee2c477124bccbf6ecb", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17868, "timestamp_epoch": "1566331164.718942000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b046fdaacef23afe69a6e009", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17869, "timestamp_epoch": "1566331164.719103000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7fad9e3f070eab6e78c17bda", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17870, "timestamp_epoch": "1566331164.719248000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-75b2c0dfd405e0be056ee8ea", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17871, "timestamp_epoch": "1566331164.719412000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-92fccf23f7bbb690b5e5bc41", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17872, "timestamp_epoch": "1566331164.719678000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d38973a42ae021e0bf288ba7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17873, "timestamp_epoch": "1566331164.720047000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-11fae53f89b70e775493a64b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17874, "timestamp_epoch": "1566331164.720222000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f522bc4c349f1f4dc0d46cf1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17875, "timestamp_epoch": "1566331164.720392000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0c534be8d915e1c73a8a840a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17876, "timestamp_epoch": "1566331164.720505000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e64c4ca2a54f9fb36e50b68c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17877, "timestamp_epoch": "1566331164.720652000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-76f50bb13ac023c8c78cad0d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17878, "timestamp_epoch": "1566331164.720786000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fac32cfd3e5f6c18abf695e0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17879, "timestamp_epoch": "1566331164.720953000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a692acf4485b9591d101c27a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17880, "timestamp_epoch": "1566331164.721295000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-3b94afa50a2397fe654baea3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17881, "timestamp_epoch": "1566331164.721681000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-248e51b6aa223f9a22b5d300", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17882, "timestamp_epoch": "1566331164.721865000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d13f39afe6b55d60b26b90f4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17883, "timestamp_epoch": "1566331164.722045000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0b4705fe4df4d28570bb5cca", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17884, "timestamp_epoch": "1566331164.722187000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5ffbda1d39c46dafaf12d438", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17885, "timestamp_epoch": "1566331164.722334000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cb4e666cc24dc58f5e023f72", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17886, "timestamp_epoch": "1566331164.722478000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e9a2e1eb0126fe3527acd44e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17887, "timestamp_epoch": "1566331164.722661000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0434c2c42b34d1187f47f661", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17888, "timestamp_epoch": "1566331164.722994000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6faf4e7d4f70da9652a971e8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17889, "timestamp_epoch": "1566331164.723397000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1e6ebebaa27742a9b30de994", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17890, "timestamp_epoch": "1566331164.723600000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ec59ee802750f87c981b41f0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17891, "timestamp_epoch": "1566331164.723782000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c0bfbe177b98de2c80b85654", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17892, "timestamp_epoch": "1566331164.723903000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2636b3b4fb1f7134a43ac6a4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17893, "timestamp_epoch": "1566331164.724091000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e5738bd7c8a48ec730978bed", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17894, "timestamp_epoch": "1566331164.724252000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ebddf3afcbae0f7b90679a1e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17895, "timestamp_epoch": "1566331164.724441000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5ded2410999a66e84d4863e4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17896, "timestamp_epoch": "1566331164.724736000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5cb1ec910c87a01d414a1c54", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17897, "timestamp_epoch": "1566331164.725111000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a7441c5ddb635a42ee36b816", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17898, "timestamp_epoch": "1566331164.725335000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-82b0511bbae588c5f570ec2a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17899, "timestamp_epoch": "1566331164.725679000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-70fb14dc24ee0dfe73daa665", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17900, "timestamp_epoch": "1566331164.725845000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dd995c589e0fc59d05802e10", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17901, "timestamp_epoch": "1566331164.726021000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-46794c9fec6fccd0ca138d9e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17902, "timestamp_epoch": "1566331164.726380000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b6b68770be5c00ce4abb6e84", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17903, "timestamp_epoch": "1566331164.726583000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b088001159793ed567642e1b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17904, "timestamp_epoch": "1566331164.726889000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-93555c8e205d51f2528119a0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17905, "timestamp_epoch": "1566331164.727249000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-10108e46180674116316fe34", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17906, "timestamp_epoch": "1566331164.727465000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dc0a298a5c991f95d21e3fa6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17907, "timestamp_epoch": "1566331164.727656000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-426ddd4168f0c019e203d014", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17908, "timestamp_epoch": "1566331164.727785000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-bac07b6b827638e4a459bee7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17909, "timestamp_epoch": "1566331164.727948000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cfca2bec334e5dccdd07c756", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17910, "timestamp_epoch": "1566331164.728100000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d7a62bb0e45a04470d22996e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17911, "timestamp_epoch": "1566331164.728319000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5b861a985d9c531ada399810", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17912, "timestamp_epoch": "1566331164.728577000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2899d275b8a1cbf5466aefcd", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17913, "timestamp_epoch": "1566331164.728980000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-152e0b5c1bfa805753ae9507", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17914, "timestamp_epoch": "1566331164.729377000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2041c85207f292d7ac5df618", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17915, "timestamp_epoch": "1566331164.729870000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0619173d397e4ea97dfcb42b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17916, "timestamp_epoch": "1566331164.730085000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ae86999fc7bad46acb787655", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17917, "timestamp_epoch": "1566331164.730437000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-da450c4325eae14dee6438d5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17918, "timestamp_epoch": "1566331164.730605000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-213ab478d7e038cb71388677", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17919, "timestamp_epoch": "1566331164.730768000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6de25a58640dca1d26c5bc8e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17920, "timestamp_epoch": "1566331164.731074000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ff3cbf80c854087f31a89e2d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17921, "timestamp_epoch": "1566331164.731539000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1a9d8099850e0639c5dcf0b8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17922, "timestamp_epoch": "1566331164.731765000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-77f236f580ba0b32ace7ac32", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17923, "timestamp_epoch": "1566331164.731937000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d65a618fa364c5c124e8c193", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17924, "timestamp_epoch": "1566331164.732055000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-444b153258484d265413d162", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17925, "timestamp_epoch": "1566331164.732196000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-66e39626facd99366cfb17a6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17926, "timestamp_epoch": "1566331164.732334000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f174f43169d0f3b1665734f0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17927, "timestamp_epoch": "1566331164.732493000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-411d3d294825effd526b3836", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17928, "timestamp_epoch": "1566331164.732774000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d751ecd51d82fc7409845a05", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17929, "timestamp_epoch": "1566331164.733290000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-719116a3afb4993bc9f1dfd1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17930, "timestamp_epoch": "1566331164.733519000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e792b1eb9bd8febdc0f3d928", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17931, "timestamp_epoch": "1566331164.733780000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0b7d7a12affffa5e98a199ce", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17932, "timestamp_epoch": "1566331164.733914000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2928401e79da59ded9487130", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17933, "timestamp_epoch": "1566331164.734062000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cf787467f26ed5f064cdb1d6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17934, "timestamp_epoch": "1566331164.734223000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-633bded31aad022a457e5dbc", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17935, "timestamp_epoch": "1566331164.734413000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-10d26a0b59ec49212500c321", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17936, "timestamp_epoch": "1566331164.734836000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-50282ffbee1395035b32d4f0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17937, "timestamp_epoch": "1566331164.735633000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-dcae3fca622a56965ada3c3a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17938, "timestamp_epoch": "1566331164.735909000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5373fd43e9ec7951018c55c4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17939, "timestamp_epoch": "1566331164.736110000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8903585e3f720ca1f7377137", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17940, "timestamp_epoch": "1566331164.736236000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fa77b91bafd6c28421180502", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17941, "timestamp_epoch": "1566331164.736520000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8b101e0303fc71da48bb3853", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17942, "timestamp_epoch": "1566331164.736678000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c157f1e093b903ec3221ae8b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17943, "timestamp_epoch": "1566331164.736850000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-152d95616249910acbcb80f8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17944, "timestamp_epoch": "1566331164.737116000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7d5d2930c0999e3e1d27c6b4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17945, "timestamp_epoch": "1566331164.737491000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-dcb8b0b2196bb8c5207ff310", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17946, "timestamp_epoch": "1566331164.737725000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1050a4f04e9afc0bcd68d744", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17947, "timestamp_epoch": "1566331164.737904000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8f146a6e6fa177286a6e2eda", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17948, "timestamp_epoch": "1566331164.738023000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2f6d8be4141cd654376957b3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17949, "timestamp_epoch": "1566331164.738184000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-20a89f82ded226dd29763995", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17950, "timestamp_epoch": "1566331164.738331000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9edbfa4c81dec5e8411d15b0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17951, "timestamp_epoch": "1566331164.738501000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1bafd42ab1bf474685b8084f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17952, "timestamp_epoch": "1566331164.738769000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fb57e1439705ccbbe7ee8089", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17953, "timestamp_epoch": "1566331164.739127000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-709d650a4ea4d9728925d78e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17954, "timestamp_epoch": "1566331164.739355000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-baae8f3979ebf696031af871", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17955, "timestamp_epoch": "1566331164.739563000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-96da4753b99866b0ca3f1721", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17956, "timestamp_epoch": "1566331164.739702000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7d5be98cf65b9a37ffad16d4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17957, "timestamp_epoch": "1566331164.739879000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-967e321a71a7347729d4e3e4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17958, "timestamp_epoch": "1566331164.740028000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b89c6ce196f4cd2d61a5e0a2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17959, "timestamp_epoch": "1566331164.740208000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-970ae5575a3cb456041e09ce", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17960, "timestamp_epoch": "1566331164.740529000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-68c9f0f8072b4536b3933441", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17961, "timestamp_epoch": "1566331164.741343000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d7bc6add322752e02c929680", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17962, "timestamp_epoch": "1566331164.741605000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6c2394585b6d6a19b09f7a2c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17963, "timestamp_epoch": "1566331164.741842000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8dcbc58cee0e4abdb0433551", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17964, "timestamp_epoch": "1566331164.741993000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-24cb5329b3fb32f34b6bb445", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17965, "timestamp_epoch": "1566331164.742195000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a96f87cae4c101d385c54c6e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17966, "timestamp_epoch": "1566331164.742381000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-82e31fd128b138dff13a7b8b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17967, "timestamp_epoch": "1566331164.742632000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-78b2e40029f99a35b8e42d25", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17968, "timestamp_epoch": "1566331164.743014000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-774b1bda9df90ff8d32f0f58", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17969, "timestamp_epoch": "1566331164.743470000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ebc6d23c69530a1b1379e2a6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17970, "timestamp_epoch": "1566331164.743719000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0011d483432a19550f2cea23", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17971, "timestamp_epoch": "1566331164.744226000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7d86026d5bd461d3b4a0005b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17972, "timestamp_epoch": "1566331164.744374000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9bde5f786facab26a0dd55ae", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17973, "timestamp_epoch": "1566331164.744709000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b1304ccabe49e97116c9beac", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17974, "timestamp_epoch": "1566331164.745057000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8d6c2ca1b680153999afdb6b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17975, "timestamp_epoch": "1566331164.745413000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e6f8ced2115932105864e1ea", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17976, "timestamp_epoch": "1566331164.745734000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-995c71e21613e23d6041f45a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17977, "timestamp_epoch": "1566331164.746668000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-86daf2f09382862b68d25d92", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17978, "timestamp_epoch": "1566331164.746930000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e9744a9990b14b82c75b866f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17979, "timestamp_epoch": "1566331164.747138000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-245e3257310e954c2801580c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17980, "timestamp_epoch": "1566331164.747271000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cc15786a4a2ba86ba767d0f4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17981, "timestamp_epoch": "1566331164.747477000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7622d58e5faf420cb5143a47", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17982, "timestamp_epoch": "1566331164.747626000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e8a85c2789e28a20ea68aa85", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17983, "timestamp_epoch": "1566331164.747790000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-77e3a2dd029932b9b427207f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17984, "timestamp_epoch": "1566331164.748061000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9f4ae580358dcffc73378427", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17985, "timestamp_epoch": "1566331164.748714000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-16fc0b75bf8fa694cbb9f6c8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17986, "timestamp_epoch": "1566331164.748945000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-63f5c1f321ce0c4008b36088", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17987, "timestamp_epoch": "1566331164.749167000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fb8f8bc4b765e3d4bc1424c1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17988, "timestamp_epoch": "1566331164.749280000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-24e17eb9bb3f2814bc137bf0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17989, "timestamp_epoch": "1566331164.749437000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-549e2dc865b09587bebbaeea", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17990, "timestamp_epoch": "1566331164.749577000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a2dc1e206913e5b3eee946bd", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17991, "timestamp_epoch": "1566331164.749747000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3246b3af7ec75835646917c2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17992, "timestamp_epoch": "1566331164.750011000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fd8e1762f18a144d38aa3463", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17993, "timestamp_epoch": "1566331164.750619000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7182cc9192a53aaf8a94d29a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17994, "timestamp_epoch": "1566331164.751016000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ad312294dd171033ce8dae02", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17995, "timestamp_epoch": "1566331164.751347000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-79471ccf746e97f778efd865", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17996, "timestamp_epoch": "1566331164.751507000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-09bf46679e91b77fa9a203a7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17997, "timestamp_epoch": "1566331164.751728000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b731d7730fa22c615a08670e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17998, "timestamp_epoch": "1566331164.751898000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-437a82e6eb7beb9e3d8777e1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 17999, "timestamp_epoch": "1566331164.752098000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4de0539285ee7f0d6339c9a7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18000, "timestamp_epoch": "1566331164.752419000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c4d6a40ca15aefa33f9fa8ab", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18001, "timestamp_epoch": "1566331164.753010000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-dea0b91a77fe44b712a7bbc3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18002, "timestamp_epoch": "1566331164.753325000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-dd51ee19a19c45cca0b80152", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18003, "timestamp_epoch": "1566331164.753598000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f395ec2db1ca1015009a5cd7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18004, "timestamp_epoch": "1566331164.753716000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9f799dc6d5bd28a21760cb71", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18005, "timestamp_epoch": "1566331164.753861000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4c6a62a14e85092b7f0010af", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18006, "timestamp_epoch": "1566331164.754000000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c8527be72fc81371a1ac85ab", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18007, "timestamp_epoch": "1566331164.754171000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9a5691dca9668d84f4b9e569", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18008, "timestamp_epoch": "1566331164.754451000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-07659c9dd10f216ac3c1bc1c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18009, "timestamp_epoch": "1566331164.754791000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-033bea16270cdf22b49136e4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18010, "timestamp_epoch": "1566331164.755106000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a4541d0b8e45a6bc9f601787", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18011, "timestamp_epoch": "1566331164.755418000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-df8685ac2818eea142d3efc9", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18012, "timestamp_epoch": "1566331164.755550000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-94b869310b1d1952b2d61442", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18013, "timestamp_epoch": "1566331164.755692000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f9a8aeb2777678f8591ad78d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18014, "timestamp_epoch": "1566331164.755834000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-005e0382bc6e0c61265fcc7d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18015, "timestamp_epoch": "1566331164.756013000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-56bf4188f94d1a81c0aa78c2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18016, "timestamp_epoch": "1566331164.756302000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fb5b30b5ab6e12deb0af7178", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18017, "timestamp_epoch": "1566331164.756813000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4afed671b5089aefb0f068f3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18018, "timestamp_epoch": "1566331164.757162000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f339ee234d78b547000f6351", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18019, "timestamp_epoch": "1566331164.757492000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-dce5008df403528ccab65521", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18020, "timestamp_epoch": "1566331164.757635000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7859c452bd25a85a883523ce", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18021, "timestamp_epoch": "1566331164.757876000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a4ec125d93cd4a00e080ba71", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18022, "timestamp_epoch": "1566331164.758186000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-be3b3e608339c8f5bcf36b00", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18023, "timestamp_epoch": "1566331164.758593000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-924d35b4f5eda32047cf850d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18024, "timestamp_epoch": "1566331164.758931000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e50062e50087f9ad942c3754", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18025, "timestamp_epoch": "1566331164.759570000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-522ff79a90121085a6d90fa0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18026, "timestamp_epoch": "1566331164.760003000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d1dfad743f40c8a2811a9220", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18027, "timestamp_epoch": "1566331164.760328000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9babb6f73d4d7cd3f0893b09", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18028, "timestamp_epoch": "1566331164.760499000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5a7edadff971640a3c45f150", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18029, "timestamp_epoch": "1566331164.760669000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e40c03a5a5af0e045a3acc30", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18030, "timestamp_epoch": "1566331164.760945000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4b1a236857b585f25ce36da0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18031, "timestamp_epoch": "1566331164.761124000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-08413d9f425ec57e05a7e998", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18032, "timestamp_epoch": "1566331164.761419000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5a6b09fbf4828d98a9b411ea", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18033, "timestamp_epoch": "1566331164.762222000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-92a71eb8f0c31f88e8ecb06d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18034, "timestamp_epoch": "1566331164.762598000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-574c110548eda5b07ff0a5e6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18035, "timestamp_epoch": "1566331164.762962000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-481461f0870f71013db0975f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18036, "timestamp_epoch": "1566331164.763155000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b292ca45369aabf88432ddf2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18037, "timestamp_epoch": "1566331164.763316000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-157eea77b78456e32720c6aa", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18038, "timestamp_epoch": "1566331164.763490000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-452ca3861621be53c02ed77d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18039, "timestamp_epoch": "1566331164.763685000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0f6d7c80922b614970b3ff29", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18040, "timestamp_epoch": "1566331164.764035000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ced22849124c1ca8c4a9d758", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18041, "timestamp_epoch": "1566331164.764882000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e55f096b64befb149b114cb4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18042, "timestamp_epoch": "1566331164.765198000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cd78d92be12bc7a193498d00", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18043, "timestamp_epoch": "1566331164.765552000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6f573788a335903a584e3664", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18044, "timestamp_epoch": "1566331164.765675000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-db213d79caf4461160629151", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18045, "timestamp_epoch": "1566331164.765838000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d9ebf9d70ffcb6fd25796281", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18046, "timestamp_epoch": "1566331164.766004000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2e02992ede6dfc48e5774b80", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18047, "timestamp_epoch": "1566331164.766197000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7a3b21962b4b11e27444f2e1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18048, "timestamp_epoch": "1566331164.766527000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-70720ecda286956dc384c25f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18049, "timestamp_epoch": "1566331164.766940000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-97a84a273ed2b245e032a877", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18050, "timestamp_epoch": "1566331164.767481000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-709b2b14cf8a9e212bacfe0d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18051, "timestamp_epoch": "1566331164.767779000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-524504625ebe8c87579dc33e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18052, "timestamp_epoch": "1566331164.767989000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-deb036910c837d1081754453", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18053, "timestamp_epoch": "1566331164.768261000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d5b10e629da3d5510ead5dfa", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18054, "timestamp_epoch": "1566331164.768499000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f2412029d5d2b1f879881476", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18055, "timestamp_epoch": "1566331164.768755000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4010b90cd970f9fece51f77f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18056, "timestamp_epoch": "1566331164.769129000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9f7dcf2e77c2b9150f914537", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18057, "timestamp_epoch": "1566331164.769855000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c1d3e02830539fd17e1e3e63", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18058, "timestamp_epoch": "1566331164.770222000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2cc2ae24386514cbe90847b0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18059, "timestamp_epoch": "1566331164.770435000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-75e20e2b12fef3b73768c9ec", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18060, "timestamp_epoch": "1566331164.770584000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fd4ccc04d1b12311ceef3403", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18061, "timestamp_epoch": "1566331164.770754000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0ac76467495a2e41ad9174f8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18062, "timestamp_epoch": "1566331164.770925000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-523d11c6f3b8d5126b58c484", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18063, "timestamp_epoch": "1566331164.771180000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bf3d064ba883c8b8cfec9db1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18064, "timestamp_epoch": "1566331164.771569000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-84f42aa92b2dae616bfce43d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18065, "timestamp_epoch": "1566331164.772414000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-ff2ba32ee98553b399d557c5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18066, "timestamp_epoch": "1566331164.772878000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1517489ea9fd522f30749665", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18067, "timestamp_epoch": "1566331164.773115000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-01bc4ece6efcb409fd031f7d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18068, "timestamp_epoch": "1566331164.773286000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7d20ab8177d117f339687066", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18069, "timestamp_epoch": "1566331164.773487000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-080acec0f1aab8fff8190543", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18070, "timestamp_epoch": "1566331164.773720000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6e65cddf8d08b5492926b9c4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18071, "timestamp_epoch": "1566331164.773957000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b9e050a907cda099ebb42702", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18072, "timestamp_epoch": "1566331164.774335000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-585e853f4f2b9fb59e214166", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18073, "timestamp_epoch": "1566331164.774872000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-80a34a61f230300a9b69be0d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18074, "timestamp_epoch": "1566331164.775147000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d7691ea6a6aa650e35d12d5e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18075, "timestamp_epoch": "1566331164.775461000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cf342357bc29d1a63a8e9b20", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18076, "timestamp_epoch": "1566331164.775646000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b7193dd0b2f83bab64503442", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18077, "timestamp_epoch": "1566331164.775847000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bf063a8c2c5e74f035973c20", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18078, "timestamp_epoch": "1566331164.776178000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-197d6ec26177b118a4d9c2bd", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18079, "timestamp_epoch": "1566331164.776548000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-3a8e8f941fa53e88fe83566f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18080, "timestamp_epoch": "1566331164.776984000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f3b44d7f3047da51e84b578d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18081, "timestamp_epoch": "1566331164.778095000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-5bac8ac8033777bec032b2e6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18082, "timestamp_epoch": "1566331164.778353000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ebc37257d0382f4b5f8cf0bf", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18083, "timestamp_epoch": "1566331164.779027000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-53d3fdb9f6b3aabdcf057cff", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18084, "timestamp_epoch": "1566331164.779388000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-85a2258f942cef4ecf6f0551", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18085, "timestamp_epoch": "1566331164.779586000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d9b329bda89a99dd39be2166", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18086, "timestamp_epoch": "1566331164.779913000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2ec745618b46196811815944", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18087, "timestamp_epoch": "1566331164.780254000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7b13f7a5f56eb180ef784af0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18088, "timestamp_epoch": "1566331164.780571000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c4cbf3728bf6f2205093cc34", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18089, "timestamp_epoch": "1566331164.781066000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f4d377b2b45de4c9b1971d63", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18090, "timestamp_epoch": "1566331164.781320000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ce3e38cea0d5e46b80545e3e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18091, "timestamp_epoch": "1566331164.781556000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-26994390f697c7c383493278", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18092, "timestamp_epoch": "1566331164.781739000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-567ba9c51d6e6c19bee23cd3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18093, "timestamp_epoch": "1566331164.781918000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c42f99f4ce6889e6abc5248c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18094, "timestamp_epoch": "1566331164.782107000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-19713b89c599abb5fa404615", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18095, "timestamp_epoch": "1566331164.782443000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-97d96234eecfe058b419ae53", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18096, "timestamp_epoch": "1566331164.782810000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d8c9147b40180b2570a99f59", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18097, "timestamp_epoch": "1566331164.783206000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6f2483d2198bf3249f840dee", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18098, "timestamp_epoch": "1566331164.783436000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-2edf5dca30e79dd1c28e68af", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18099, "timestamp_epoch": "1566331164.783670000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e2bab3c6cee4ca7f20d4643b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18100, "timestamp_epoch": "1566331164.783833000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7a4d1209917e8b77d803b549", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18101, "timestamp_epoch": "1566331164.784015000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9b7e7bb4e73c25e2fdfc6876", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18102, "timestamp_epoch": "1566331164.784188000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-585a83ca89f94bb1a2b57580", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18103, "timestamp_epoch": "1566331164.784412000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-1ea5bb3e6294d0b0611ef45a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18104, "timestamp_epoch": "1566331164.784894000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e89556130a92b5954d9f550d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18105, "timestamp_epoch": "1566331164.785875000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f0e83b54e1439cb8a97f6f14", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18106, "timestamp_epoch": "1566331164.786220000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-594a63017334bfa48162ac16", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18107, "timestamp_epoch": "1566331164.786511000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bd0469724d3ff003e568d76d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18108, "timestamp_epoch": "1566331164.786698000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-ef0e1231c1b390834bb2f6b7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18109, "timestamp_epoch": "1566331164.786911000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a40afde74fc3ff00db02475b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18110, "timestamp_epoch": "1566331164.787104000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fa0e44bbac3526ecb4497413", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18111, "timestamp_epoch": "1566331164.787323000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-4259f35ba2b0a8a41f2a71d0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18112, "timestamp_epoch": "1566331164.787651000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d87a74fd0227458800924f34", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18113, "timestamp_epoch": "1566331164.788048000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d61b2552597fc6ab42cd48d0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18114, "timestamp_epoch": "1566331164.788269000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0a58e237645d5a6386112f7f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18115, "timestamp_epoch": "1566331164.788546000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c4e934cbae3cffea49e95aac", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18116, "timestamp_epoch": "1566331164.788708000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-f14addeaea79e73b780c0c64", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18117, "timestamp_epoch": "1566331164.788922000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-28d67f4c34e6b34d8233ce6b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18118, "timestamp_epoch": "1566331164.789103000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c28824951ab7821ec0f373a0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18119, "timestamp_epoch": "1566331164.789315000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-80556722e79b0479156e64bf", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18120, "timestamp_epoch": "1566331164.789619000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-511590d4daa78585bf2fd880", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18121, "timestamp_epoch": "1566331164.790340000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8669fe0ce0aa32dc0040a289", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18122, "timestamp_epoch": "1566331164.790543000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-de79e8c10f5b52ad3eff1052", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18123, "timestamp_epoch": "1566331164.790774000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-fd13e3b885addb5f848407f9", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18124, "timestamp_epoch": "1566331164.790932000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1d319ae4bad23f16efeeec20", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18125, "timestamp_epoch": "1566331164.791204000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6c398e5d34698c02ca56e2d8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18126, "timestamp_epoch": "1566331164.791392000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-6e6242d7fb680c6e79de1f09", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18127, "timestamp_epoch": "1566331164.791572000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-308e7f5a03b37fb6980e5a57", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18128, "timestamp_epoch": "1566331164.791902000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-730c511d740a73b606a1b114", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18129, "timestamp_epoch": "1566331164.792517000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-28d1633c863b036e63101434", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18130, "timestamp_epoch": "1566331164.792806000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-45d0efb1071602ce50c452c2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18131, "timestamp_epoch": "1566331164.793162000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d858eeee858d85645a941a14", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18132, "timestamp_epoch": "1566331164.793328000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8a4052da7f496b1edac5d11c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18133, "timestamp_epoch": "1566331164.793519000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-efeb71b47f569511a1134a99", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18134, "timestamp_epoch": "1566331164.793701000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a0589ff9aa6504a28b19479a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18135, "timestamp_epoch": "1566331164.793911000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-c66f96a32fbc49e41f457ba8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18136, "timestamp_epoch": "1566331164.794219000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-1e97ce1043955069043e71c4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18137, "timestamp_epoch": "1566331164.794840000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-9a7977a1a2731e163eb6184f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18138, "timestamp_epoch": "1566331164.795050000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e298fe645adb8aff168e0a1e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18139, "timestamp_epoch": "1566331164.795256000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-34ff704e0b67d43fbeedcaf8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18140, "timestamp_epoch": "1566331164.795407000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-34ca31d779ea9438ba006ad1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18141, "timestamp_epoch": "1566331164.795690000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e4ed84bfcd7b1420b2f5595d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18142, "timestamp_epoch": "1566331164.795871000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c69126953bc49a00c5df74f4", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18143, "timestamp_epoch": "1566331164.796090000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-6714b3e3cb0c994157204ebd", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18144, "timestamp_epoch": "1566331164.796405000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5974991ad243e4da3dc594c1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18145, "timestamp_epoch": "1566331164.796857000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-019427ab49c36981f71d8002", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18146, "timestamp_epoch": "1566331164.797064000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b54137f7e5d5b8e434c9fc17", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18147, "timestamp_epoch": "1566331164.797367000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d9db503f730335f41752e9fa", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18148, "timestamp_epoch": "1566331164.797521000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-fc5836c4a6781b3b056eb42a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18149, "timestamp_epoch": "1566331164.797695000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-487ba5ce5f64ab770cc203a9", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18150, "timestamp_epoch": "1566331164.797877000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-888c26ac947fd91ccce96723", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18151, "timestamp_epoch": "1566331164.798082000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0cdfa516b34212a7670993db", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18152, "timestamp_epoch": "1566331164.798372000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-62286a977183b7b987cda2d1", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18153, "timestamp_epoch": "1566331164.799028000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f91e6c6ebfd45ce311b84791", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18154, "timestamp_epoch": "1566331164.799265000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-863ebc86326f09c224be0628", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18155, "timestamp_epoch": "1566331164.799483000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2ca408a08f07314dac9d7e65", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18156, "timestamp_epoch": "1566331164.799645000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5c12275d04622e1010839064", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18157, "timestamp_epoch": "1566331164.799929000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-17cba4b6e946737150de977b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18158, "timestamp_epoch": "1566331164.800120000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-734c2ad1d57cf12533252f79", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18159, "timestamp_epoch": "1566331164.800371000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7f4610a331ef9a151a670456", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18160, "timestamp_epoch": "1566331164.800774000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-28d5be80a43b6850a5320ad3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18161, "timestamp_epoch": "1566331164.801778000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bb69acec9177720092f37f19", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18162, "timestamp_epoch": "1566331164.802099000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-accbabfb47b64204f72b5402", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18163, "timestamp_epoch": "1566331164.802487000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a3f735d9e9fa95c48daaa17c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18164, "timestamp_epoch": "1566331164.802676000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4e315a5d3c26e2c93e7b3d55", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18165, "timestamp_epoch": "1566331164.802911000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bd88dc30dc82d397b738b647", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18166, "timestamp_epoch": "1566331164.803264000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d16485e31ad1ab6b57575343", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18167, "timestamp_epoch": "1566331164.803488000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-603630fc9f93a3c6762150b6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18168, "timestamp_epoch": "1566331164.803868000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-61c6179114ed9357d116557e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18169, "timestamp_epoch": "1566331164.805138000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-38fb8d68c57cb5a13c94ce54", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18170, "timestamp_epoch": "1566331164.805517000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0bfae4c7068c02463e3438fa", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18171, "timestamp_epoch": "1566331164.805794000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-cd860f379366e433ba269b31", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18172, "timestamp_epoch": "1566331164.805972000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-afcc1cf00661258e2e43322e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18173, "timestamp_epoch": "1566331164.806359000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-71a392eea41e9a6b1526d90f", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18174, "timestamp_epoch": "1566331164.806645000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4be4eb282407fbc39f1c5ec5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18175, "timestamp_epoch": "1566331164.806903000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8f97de0eb4de31c1da89bf62", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18176, "timestamp_epoch": "1566331164.807272000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7ce14a0bb30080bec12cde95", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18177, "timestamp_epoch": "1566331164.807676000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a7134e8bff822d43dd6d7e02", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18178, "timestamp_epoch": "1566331164.807905000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-8c70aed2537e4e9d93682843", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18179, "timestamp_epoch": "1566331164.808079000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-0bf285b65a695327de9d437a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18180, "timestamp_epoch": "1566331164.808218000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a9d60e08e8df5916558861a2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18181, "timestamp_epoch": "1566331164.808515000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-b0920693380b1235d9b247b3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18182, "timestamp_epoch": "1566331164.808697000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e682fa3f39e62651776ded21", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18183, "timestamp_epoch": "1566331164.808889000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f3c8b8bf211a267ff1d92abb", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18184, "timestamp_epoch": "1566331164.809402000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-67adaf6a8b30e49f8e6ab8ae", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18185, "timestamp_epoch": "1566331164.810251000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-29d3a1de71745b8e49762130", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18186, "timestamp_epoch": "1566331164.810498000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-9d059890ab633e7cff6a028a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18187, "timestamp_epoch": "1566331164.810810000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e537de869514c804fa043fe7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18188, "timestamp_epoch": "1566331164.810951000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-5e1c2b2a187637b79c55fd33", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18189, "timestamp_epoch": "1566331164.811116000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-e0bbff1d37223734d5479196", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18190, "timestamp_epoch": "1566331164.811276000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-c47148912846e2368022c95d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18191, "timestamp_epoch": "1566331164.811449000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-a74212979d30c2d8d7c3bf36", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18192, "timestamp_epoch": "1566331164.811738000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-0562eb75d3f17625823e2953", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18193, "timestamp_epoch": "1566331164.812228000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-50ade2f5a40439622d37def6", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18194, "timestamp_epoch": "1566331164.812424000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-13edeef4e2cf114d9cd28148", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18195, "timestamp_epoch": "1566331164.812602000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-378a6312c28e6f8c8d260574", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18196, "timestamp_epoch": "1566331164.812720000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a3784fae2dacd30fff034d64", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18197, "timestamp_epoch": "1566331164.813022000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f4590f1269867d815bb7106d", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18198, "timestamp_epoch": "1566331164.813167000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-e32416bce8349fd238d92966", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18199, "timestamp_epoch": "1566331164.813336000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-82e18b2bda538b7d4962255a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18200, "timestamp_epoch": "1566331164.813609000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-06fe39ccfb4f59030ab1b756", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18201, "timestamp_epoch": "1566331164.813991000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-83f0f898ab39b34d1e0a3951", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18202, "timestamp_epoch": "1566331164.814170000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-b2c1300ec945397f9ce16879", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18203, "timestamp_epoch": "1566331164.814340000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-f2f0de182781c7a9081f52eb", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18204, "timestamp_epoch": "1566331164.814481000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7006e18ad7c9dbc7a76e5e6c", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18205, "timestamp_epoch": "1566331164.814769000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-72598afbdf9bf6de1aa74eaa", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18206, "timestamp_epoch": "1566331164.814913000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-d8ea1c47f47e085f643659d3", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18207, "timestamp_epoch": "1566331164.815076000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-44c9f188324ef84eba165dbc", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18208, "timestamp_epoch": "1566331164.815334000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4aeff60d4389845f57334c78", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18209, "timestamp_epoch": "1566331164.815877000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-d1da2548c39f5c631c170d84", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18210, "timestamp_epoch": "1566331164.816049000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-af48373460dcd19c43f2089a", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18211, "timestamp_epoch": "1566331164.816273000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-025d99dcb3f415744c2e5365", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18212, "timestamp_epoch": "1566331164.816395000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-7b441f5ff254b5f8810e6dc2", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18213, "timestamp_epoch": "1566331164.816550000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-99a395081afb59b951979a14", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18214, "timestamp_epoch": "1566331164.816722000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-39e2377176a8ce4491f0fff7", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18215, "timestamp_epoch": "1566331164.816924000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-48dbcc06efcf1bd4769e0de5", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18216, "timestamp_epoch": "1566331164.817359000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-4c6b752e6a693544bd5f1529", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18217, "timestamp_epoch": "1566331164.818353000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-7661d57e413bbbd54028af0e", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18218, "timestamp_epoch": "1566331164.818688000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-cdbbbd871c723880cd132765", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18219, "timestamp_epoch": "1566331164.819295000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-2e61a529e97f8196d51ea217", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18220, "timestamp_epoch": "1566331164.819547000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-a6e94476343fb4b5729c0768", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18221, "timestamp_epoch": "1566331164.819896000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-adf5743696f8cc5afa271f76", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18222, "timestamp_epoch": "1566331164.820100000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-344d05d9ad165552f9ddecc8", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18223, "timestamp_epoch": "1566331164.820466000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-bc38164371d607a0172141a0", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18224, "timestamp_epoch": "1566331164.820813000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "CN=Users,DC=badbundt,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-002ea721a4c6af176050d18b", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18225, "timestamp_epoch": "1566331164.821722000" }, { "kind": "directory_service", "dst_ip": "10.8.20.101", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.8.20.8", "dst_port": null, "event_id": "evt-8ab7a741e15a60e5ce5f5415", "src_port": null, "tcp_stream": 151, "udp_stream": null, "frame_number": 18226, "timestamp_epoch": "1566331164.822076000" }, { "kind": "directory_service", "dst_ip": "10.8.20.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.8.20.101", "dst_port": null, "event_id": "evt-593f70211fdb73089ddf5219", "src_port": null, "tcp_stream": 150, "udp_stream": null, "frame_number": 18227, "timestamp_epoch": "1566331164.822413000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 18943, "interface_ids": [], "source_sha256": "500da44cbb442f282549a28815bec1dc55e6c0120286c532c43f8dd4a8c5d94d", "captured_bytes": 12941642, "protocol_counts": { "ip": 18943, "dns": 102, "eth": 18943, "ntp": 6, "png": 2, "smb": 4273, "tcp": 18634, "tls": 953, "udp": 299, "data": 34, "http": 44, "igmp": 20, "ldap": 1136, "nbns": 77, "nbss": 4442, "smb2": 253, "ssdp": 6, "cldap": 12, "llmnr": 12, "media": 7, "nbdgm": 84, "dcerpc": 84, "pkcs-1": 3, "spnego": 143, "x509ce": 340, "browser": 84, "gss-api": 857, "ntlmssp": 48, "x509sat": 667, "kerberos": 48, "ethertype": 18943, "spnego-krb5": 848, "pkix1explicit": 18, "pkix1implicit": 33, "mime_multipart": 5, "data-text-lines": 11 }, "duration_seconds": 2266.867922, "last_packet_epoch": "1566331716.733467", "source_size_bytes": 13244754, "first_packet_epoch": "1566329449.865545", "encapsulation_types": [ 1 ] }, "summary": "Decoded 18943 packets across 29 IP endpoints and 248 transport flows. Observed 102 DNS events, 28 HTTP requests, 56 TLS ClientHello events, and 21 recovered file/message object(s). Deterministic rules produced 8 finding(s): 1 high, 3 medium, and 4 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 102, "truncated": false }, "dhcp": { "returned": 0, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 557, "truncated": false }, "http_request": { "returned": 28, "truncated": false }, "http_response": { "returned": 22, "truncated": false }, "tls_client_hello": { "returned": 56, "truncated": false }, "unclassified_tcp": { "returned": 13, "truncated": false }, "directory_service": { "returned": 811, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 5261951, "export_status": "completed", "unique_hashes": 21, "hashed_objects": 26, "compact_objects": 0, "detailed_objects": 21, "exported_objects": 26, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 21 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/wp-content/uploads/2019/08/3antifreeze.rar", "source": "206.189.74.47", "destination": "10.8.20.101", "content_type": "text/html; charset=iso-8859-1", "response_count": 1, "declared_body_bytes": 276 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" }, { "tcp_stream": 72, "frame_number": 3253, "display_filter": "frame.number == 3253", "timestamp_epoch": "1566330403.446640000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-0abca24489f4e58174b4b6c1", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/wp-content/uploads/2019/08/antifreeze.rar", "source": "68.183.185.221", "destination": "10.8.20.101", "content_type": "application/rar", "response_count": 1, "declared_body_bytes": 753229 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" }, { "tcp_stream": 130, "frame_number": 13445, "display_filter": "frame.number == 13445", "timestamp_epoch": "1566330706.025314000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c4ea391d4f3753716864fcd1", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.8.20.101", "protocol": "drsuapi", "destination": "10.8.20.8", "event_count": 14, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1566329450.544372000" }, { "tcp_stream": 17, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1566329450.545907000" }, { "tcp_stream": 17, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1566329450.547251000" }, { "tcp_stream": 17, "frame_number": 253, "display_filter": "frame.number == 253", "timestamp_epoch": "1566329450.547763000" }, { "tcp_stream": 17, "frame_number": 537, "display_filter": "frame.number == 537", "timestamp_epoch": "1566329464.420238000" }, { "tcp_stream": 17, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1566329464.420682000" }, { "tcp_stream": 17, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1566329464.421597000" }, { "tcp_stream": 17, "frame_number": 543, "display_filter": "frame.number == 543", "timestamp_epoch": "1566329464.422330000" }, { "tcp_stream": 96, "frame_number": 8982, "display_filter": "frame.number == 8982", "timestamp_epoch": "1566330632.479839000" }, { "tcp_stream": 96, "frame_number": 8984, "display_filter": "frame.number == 8984", "timestamp_epoch": "1566330632.480319000" }, { "tcp_stream": 96, "frame_number": 8986, "display_filter": "frame.number == 8986", "timestamp_epoch": "1566330632.481604000" }, { "tcp_stream": 96, "frame_number": 8990, "display_filter": "frame.number == 8990", "timestamp_epoch": "1566330632.484285000" }, { "tcp_stream": 96, "frame_number": 8992, "display_filter": "frame.number == 8992", "timestamp_epoch": "1566330632.484657000" }, { "tcp_stream": 96, "frame_number": 8994, "display_filter": "frame.number == 8994", "timestamp_epoch": "1566330632.485101000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-f6ce7ec944c715a11a748158", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.8.20.101", "protocol": "ldap", "destination": "10.8.20.8", "event_count": 397, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 44, "display_filter": "frame.number == 44", "timestamp_epoch": "1566329450.033276000" }, { "tcp_stream": 2, "frame_number": 84, "display_filter": "frame.number == 84", "timestamp_epoch": "1566329450.075055000" }, { "tcp_stream": 2, "frame_number": 91, "display_filter": "frame.number == 91", "timestamp_epoch": "1566329450.076399000" }, { "tcp_stream": 2, "frame_number": 93, "display_filter": "frame.number == 93", "timestamp_epoch": "1566329450.077176000" }, { "tcp_stream": 11, "frame_number": 152, "display_filter": "frame.number == 152", "timestamp_epoch": "1566329450.175912000" }, { "tcp_stream": 11, "frame_number": 171, "display_filter": "frame.number == 171", "timestamp_epoch": "1566329450.182377000" }, { "tcp_stream": 2, "frame_number": 176, "display_filter": "frame.number == 176", "timestamp_epoch": "1566329450.183516000" }, { "tcp_stream": 11, "frame_number": 182, "display_filter": "frame.number == 182", "timestamp_epoch": "1566329450.184741000" }, { "tcp_stream": 2, "frame_number": 196, "display_filter": "frame.number == 196", "timestamp_epoch": "1566329450.285218000" }, { "tcp_stream": 2, "frame_number": 204, "display_filter": "frame.number == 204", "timestamp_epoch": "1566329450.288233000" }, { "tcp_stream": 2, "frame_number": 212, "display_filter": "frame.number == 212", "timestamp_epoch": "1566329450.290352000" }, { "tcp_stream": 2, "frame_number": 215, "display_filter": "frame.number == 215", "timestamp_epoch": "1566329450.291003000" }, { "tcp_stream": 2, "frame_number": 217, "display_filter": "frame.number == 217", "timestamp_epoch": "1566329450.291770000" }, { "tcp_stream": 19, "frame_number": 268, "display_filter": "frame.number == 268", "timestamp_epoch": "1566329451.123567000" }, { "tcp_stream": 19, "frame_number": 273, "display_filter": "frame.number == 273", "timestamp_epoch": "1566329451.125010000" }, { "tcp_stream": 19, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1566329451.136427000" }, { "tcp_stream": 23, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1566329451.139965000" }, { "tcp_stream": 23, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1566329451.140856000" }, { "tcp_stream": 23, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1566329451.141179000" }, { "tcp_stream": 19, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1566329451.141606000" }, { "tcp_stream": 23, "frame_number": 365, "display_filter": "frame.number == 365", "timestamp_epoch": "1566329451.153597000" }, { "tcp_stream": 19, "frame_number": 371, "display_filter": "frame.number == 371", "timestamp_epoch": "1566329451.535969000" }, { "tcp_stream": 28, "frame_number": 426, "display_filter": "frame.number == 426", "timestamp_epoch": "1566329460.822107000" }, { "tcp_stream": 28, "frame_number": 431, "display_filter": "frame.number == 431", "timestamp_epoch": "1566329460.823517000" }, { "tcp_stream": 28, "frame_number": 434, "display_filter": "frame.number == 434", "timestamp_epoch": "1566329460.825247000" }, { "tcp_stream": 28, "frame_number": 436, "display_filter": "frame.number == 436", "timestamp_epoch": "1566329460.825539000" }, { "tcp_stream": 28, "frame_number": 438, "display_filter": "frame.number == 438", "timestamp_epoch": "1566329460.825828000" }, { "tcp_stream": 28, "frame_number": 440, "display_filter": "frame.number == 440", "timestamp_epoch": "1566329460.826169000" }, { "tcp_stream": 29, "frame_number": 446, "display_filter": "frame.number == 446", "timestamp_epoch": "1566329460.835897000" }, { "tcp_stream": 29, "frame_number": 449, "display_filter": "frame.number == 449", "timestamp_epoch": "1566329460.836837000" }, { "tcp_stream": 29, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1566329460.860578000" }, { "tcp_stream": 29, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1566329460.861792000" }, { "tcp_stream": 28, "frame_number": 485, "display_filter": "frame.number == 485", "timestamp_epoch": "1566329460.862306000" }, { "tcp_stream": 40, "frame_number": 610, "display_filter": "frame.number == 610", "timestamp_epoch": "1566329464.948829000" }, { "tcp_stream": 40, "frame_number": 613, "display_filter": "frame.number == 613", "timestamp_epoch": "1566329464.951178000" }, { "tcp_stream": 42, "frame_number": 619, "display_filter": "frame.number == 619", "timestamp_epoch": "1566329464.954888000" }, { "tcp_stream": 42, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1566329464.956237000" }, { "tcp_stream": 42, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1566329464.956800000" }, { "tcp_stream": 40, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1566329464.957446000" }, { "tcp_stream": 42, "frame_number": 644, "display_filter": "frame.number == 644", "timestamp_epoch": "1566329464.965366000" }, { "tcp_stream": 40, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1566329465.464476000" }, { "tcp_stream": 97, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1566330632.608580000" }, { "tcp_stream": 97, "frame_number": 9008, "display_filter": "frame.number == 9008", "timestamp_epoch": "1566330632.609641000" }, { "tcp_stream": 97, "frame_number": 9011, "display_filter": "frame.number == 9011", "timestamp_epoch": "1566330632.611386000" }, { "tcp_stream": 97, "frame_number": 9013, "display_filter": "frame.number == 9013", "timestamp_epoch": "1566330632.614231000" }, { "tcp_stream": 97, "frame_number": 9015, "display_filter": "frame.number == 9015", "timestamp_epoch": "1566330632.615715000" }, { "tcp_stream": 97, "frame_number": 9017, "display_filter": "frame.number == 9017", "timestamp_epoch": "1566330632.616504000" }, { "tcp_stream": 98, "frame_number": 9226, "display_filter": "frame.number == 9226", "timestamp_epoch": "1566330632.701015000" }, { "tcp_stream": 98, "frame_number": 9231, "display_filter": "frame.number == 9231", "timestamp_epoch": "1566330632.702310000" }, { "tcp_stream": 98, "frame_number": 9234, "display_filter": "frame.number == 9234", "timestamp_epoch": "1566330632.703648000" }, { "tcp_stream": 98, "frame_number": 9236, "display_filter": "frame.number == 9236", "timestamp_epoch": "1566330632.704076000" }, { "tcp_stream": 98, "frame_number": 9238, "display_filter": "frame.number == 9238", "timestamp_epoch": "1566330632.704580000" }, { "tcp_stream": 98, "frame_number": 9240, "display_filter": "frame.number == 9240", "timestamp_epoch": "1566330632.704951000" }, { "tcp_stream": 98, "frame_number": 9242, "display_filter": "frame.number == 9242", "timestamp_epoch": "1566330632.709048000" }, { "tcp_stream": 98, "frame_number": 9244, "display_filter": "frame.number == 9244", "timestamp_epoch": "1566330632.711170000" }, { "tcp_stream": 98, "frame_number": 9246, "display_filter": "frame.number == 9246", "timestamp_epoch": "1566330632.711475000" }, { "tcp_stream": 98, "frame_number": 9248, "display_filter": "frame.number == 9248", "timestamp_epoch": "1566330632.711818000" }, { "tcp_stream": 98, "frame_number": 9250, "display_filter": "frame.number == 9250", "timestamp_epoch": "1566330632.712602000" }, { "tcp_stream": 98, "frame_number": 9252, "display_filter": "frame.number == 9252", "timestamp_epoch": "1566330632.713194000" }, { "tcp_stream": 98, "frame_number": 9254, "display_filter": "frame.number == 9254", "timestamp_epoch": "1566330632.713608000" }, { "tcp_stream": 98, "frame_number": 9256, "display_filter": "frame.number == 9256", "timestamp_epoch": "1566330632.714215000" }, { "tcp_stream": 98, "frame_number": 9258, "display_filter": "frame.number == 9258", "timestamp_epoch": "1566330632.714994000" }, { "tcp_stream": 98, "frame_number": 9260, "display_filter": "frame.number == 9260", "timestamp_epoch": "1566330632.715418000" }, { "tcp_stream": 98, "frame_number": 9262, "display_filter": "frame.number == 9262", "timestamp_epoch": "1566330632.715688000" }, { "tcp_stream": 98, "frame_number": 9264, "display_filter": "frame.number == 9264", "timestamp_epoch": "1566330632.716007000" }, { "tcp_stream": 98, "frame_number": 9266, "display_filter": "frame.number == 9266", "timestamp_epoch": "1566330632.716717000" }, { "tcp_stream": 98, "frame_number": 9268, "display_filter": "frame.number == 9268", "timestamp_epoch": "1566330632.717341000" }, { "tcp_stream": 98, "frame_number": 9270, "display_filter": "frame.number == 9270", "timestamp_epoch": "1566330632.717722000" }, { "tcp_stream": 98, "frame_number": 9272, "display_filter": "frame.number == 9272", "timestamp_epoch": "1566330632.718660000" }, { "tcp_stream": 98, "frame_number": 9274, "display_filter": "frame.number == 9274", "timestamp_epoch": "1566330632.719759000" }, { "tcp_stream": 98, "frame_number": 9276, "display_filter": "frame.number == 9276", "timestamp_epoch": "1566330632.720206000" }, { "tcp_stream": 98, "frame_number": 9278, "display_filter": "frame.number == 9278", "timestamp_epoch": "1566330632.720523000" }, { "tcp_stream": 98, "frame_number": 9280, "display_filter": "frame.number == 9280", "timestamp_epoch": "1566330632.720907000" }, { "tcp_stream": 98, "frame_number": 9282, "display_filter": "frame.number == 9282", "timestamp_epoch": "1566330632.721748000" }, { "tcp_stream": 98, "frame_number": 9284, "display_filter": "frame.number == 9284", "timestamp_epoch": "1566330632.722147000" }, { "tcp_stream": 98, "frame_number": 9286, "display_filter": "frame.number == 9286", "timestamp_epoch": "1566330632.722415000" }, { "tcp_stream": 98, "frame_number": 9288, "display_filter": "frame.number == 9288", "timestamp_epoch": "1566330632.722737000" }, { "tcp_stream": 98, "frame_number": 9290, "display_filter": "frame.number == 9290", "timestamp_epoch": "1566330632.723404000" }, { "tcp_stream": 98, "frame_number": 9292, "display_filter": "frame.number == 9292", "timestamp_epoch": "1566330632.723783000" }, { "tcp_stream": 98, "frame_number": 9294, "display_filter": "frame.number == 9294", "timestamp_epoch": "1566330632.724044000" }, { "tcp_stream": 98, "frame_number": 9296, "display_filter": "frame.number == 9296", "timestamp_epoch": "1566330632.724362000" }, { "tcp_stream": 98, "frame_number": 9298, "display_filter": "frame.number == 9298", "timestamp_epoch": "1566330632.725090000" }, { "tcp_stream": 98, "frame_number": 9300, "display_filter": "frame.number == 9300", "timestamp_epoch": "1566330632.725462000" }, { "tcp_stream": 98, "frame_number": 9302, "display_filter": "frame.number == 9302", "timestamp_epoch": "1566330632.725717000" }, { "tcp_stream": 98, "frame_number": 9304, "display_filter": "frame.number == 9304", "timestamp_epoch": "1566330632.726025000" }, { "tcp_stream": 98, "frame_number": 9306, "display_filter": "frame.number == 9306", "timestamp_epoch": "1566330632.726682000" }, { "tcp_stream": 98, "frame_number": 9308, "display_filter": "frame.number == 9308", "timestamp_epoch": "1566330632.727108000" }, { "tcp_stream": 98, "frame_number": 9310, "display_filter": "frame.number == 9310", "timestamp_epoch": "1566330632.727364000" }, { "tcp_stream": 98, "frame_number": 9312, "display_filter": "frame.number == 9312", "timestamp_epoch": "1566330632.727667000" }, { "tcp_stream": 98, "frame_number": 9314, "display_filter": "frame.number == 9314", "timestamp_epoch": "1566330632.728317000" }, { "tcp_stream": 98, "frame_number": 9316, "display_filter": "frame.number == 9316", "timestamp_epoch": "1566330632.728696000" }, { "tcp_stream": 98, "frame_number": 9318, "display_filter": "frame.number == 9318", "timestamp_epoch": "1566330632.728946000" }, { "tcp_stream": 98, "frame_number": 9320, "display_filter": "frame.number == 9320", "timestamp_epoch": "1566330632.729333000" }, { "tcp_stream": 98, "frame_number": 9322, "display_filter": "frame.number == 9322", "timestamp_epoch": "1566330632.730025000" }, { "tcp_stream": 98, "frame_number": 9324, "display_filter": "frame.number == 9324", "timestamp_epoch": "1566330632.730402000" }, { "tcp_stream": 98, "frame_number": 9326, "display_filter": "frame.number == 9326", "timestamp_epoch": "1566330632.730661000" }, { "tcp_stream": 98, "frame_number": 9328, "display_filter": "frame.number == 9328", "timestamp_epoch": "1566330632.730968000" }, { "tcp_stream": 98, "frame_number": 9330, "display_filter": "frame.number == 9330", "timestamp_epoch": "1566330632.731610000" }, { "tcp_stream": 98, "frame_number": 9332, "display_filter": "frame.number == 9332", "timestamp_epoch": "1566330632.731964000" }, { "tcp_stream": 98, "frame_number": 9334, "display_filter": "frame.number == 9334", "timestamp_epoch": "1566330632.732218000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-cb365d6af8418e8f50ee6059", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.8.20.8", "protocol": "drsuapi", "destination": "10.8.20.101", "event_count": 14, "operation_numbers": [ "0", "1", "12" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 17, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1566329450.544615000" }, { "tcp_stream": 17, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1566329450.546209000" }, { "tcp_stream": 17, "frame_number": 252, "display_filter": "frame.number == 252", "timestamp_epoch": "1566329450.547601000" }, { "tcp_stream": 17, "frame_number": 254, "display_filter": "frame.number == 254", "timestamp_epoch": "1566329450.547936000" }, { "tcp_stream": 17, "frame_number": 538, "display_filter": "frame.number == 538", "timestamp_epoch": "1566329464.420508000" }, { "tcp_stream": 17, "frame_number": 540, "display_filter": "frame.number == 540", "timestamp_epoch": "1566329464.421403000" }, { "tcp_stream": 17, "frame_number": 542, "display_filter": "frame.number == 542", "timestamp_epoch": "1566329464.422033000" }, { "tcp_stream": 17, "frame_number": 544, "display_filter": "frame.number == 544", "timestamp_epoch": "1566329464.422606000" }, { "tcp_stream": 96, "frame_number": 8983, "display_filter": "frame.number == 8983", "timestamp_epoch": "1566330632.480116000" }, { "tcp_stream": 96, "frame_number": 8985, "display_filter": "frame.number == 8985", "timestamp_epoch": "1566330632.481405000" }, { "tcp_stream": 96, "frame_number": 8987, "display_filter": "frame.number == 8987", "timestamp_epoch": "1566330632.481771000" }, { "tcp_stream": 96, "frame_number": 8991, "display_filter": "frame.number == 8991", "timestamp_epoch": "1566330632.484483000" }, { "tcp_stream": 96, "frame_number": 8993, "display_filter": "frame.number == 8993", "timestamp_epoch": "1566330632.484919000" }, { "tcp_stream": 96, "frame_number": 8995, "display_filter": "frame.number == 8995", "timestamp_epoch": "1566330632.485265000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-a7705d29c07a37008e4f158c", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.8.20.8", "protocol": "ldap", "destination": "10.8.20.101", "event_count": 386, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,4,4,4,4,4,4,4,4,4,4,19,19,19,5", "4,4,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 2, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1566329450.033547000" }, { "tcp_stream": 2, "frame_number": 89, "display_filter": "frame.number == 89", "timestamp_epoch": "1566329450.075893000" }, { "tcp_stream": 2, "frame_number": 92, "display_filter": "frame.number == 92", "timestamp_epoch": "1566329450.076605000" }, { "tcp_stream": 2, "frame_number": 95, "display_filter": "frame.number == 95", "timestamp_epoch": "1566329450.077850000" }, { "tcp_stream": 11, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1566329450.176176000" }, { "tcp_stream": 11, "frame_number": 174, "display_filter": "frame.number == 174", "timestamp_epoch": "1566329450.182993000" }, { "tcp_stream": 2, "frame_number": 179, "display_filter": "frame.number == 179", "timestamp_epoch": "1566329450.183972000" }, { "tcp_stream": 2, "frame_number": 198, "display_filter": "frame.number == 198", "timestamp_epoch": "1566329450.285667000" }, { "tcp_stream": 2, "frame_number": 206, "display_filter": "frame.number == 206", "timestamp_epoch": "1566329450.288915000" }, { "tcp_stream": 2, "frame_number": 214, "display_filter": "frame.number == 214", "timestamp_epoch": "1566329450.290739000" }, { "tcp_stream": 2, "frame_number": 216, "display_filter": "frame.number == 216", "timestamp_epoch": "1566329450.291365000" }, { "tcp_stream": 19, "frame_number": 270, "display_filter": "frame.number == 270", "timestamp_epoch": "1566329451.123933000" }, { "tcp_stream": 19, "frame_number": 275, "display_filter": "frame.number == 275", "timestamp_epoch": "1566329451.125804000" }, { "tcp_stream": 19, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1566329451.136758000" }, { "tcp_stream": 23, "frame_number": 316, "display_filter": "frame.number == 316", "timestamp_epoch": "1566329451.140475000" }, { "tcp_stream": 23, "frame_number": 318, "display_filter": "frame.number == 318", "timestamp_epoch": "1566329451.140990000" }, { "tcp_stream": 23, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1566329451.141372000" }, { "tcp_stream": 19, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1566329451.141856000" }, { "tcp_stream": 28, "frame_number": 428, "display_filter": "frame.number == 428", "timestamp_epoch": "1566329460.822386000" }, { "tcp_stream": 28, "frame_number": 433, "display_filter": "frame.number == 433", "timestamp_epoch": "1566329460.824114000" }, { "tcp_stream": 28, "frame_number": 435, "display_filter": "frame.number == 435", "timestamp_epoch": "1566329460.825387000" }, { "tcp_stream": 28, "frame_number": 437, "display_filter": "frame.number == 437", "timestamp_epoch": "1566329460.825694000" }, { "tcp_stream": 28, "frame_number": 439, "display_filter": "frame.number == 439", "timestamp_epoch": "1566329460.826027000" }, { "tcp_stream": 28, "frame_number": 441, "display_filter": "frame.number == 441", "timestamp_epoch": "1566329460.827022000" }, { "tcp_stream": 29, "frame_number": 448, "display_filter": "frame.number == 448", "timestamp_epoch": "1566329460.836498000" }, { "tcp_stream": 29, "frame_number": 450, "display_filter": "frame.number == 450", "timestamp_epoch": "1566329460.836970000" }, { "tcp_stream": 29, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1566329460.861488000" }, { "tcp_stream": 40, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1566329464.949355000" }, { "tcp_stream": 40, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1566329464.951840000" }, { "tcp_stream": 42, "frame_number": 621, "display_filter": "frame.number == 621", "timestamp_epoch": "1566329464.955707000" }, { "tcp_stream": 42, "frame_number": 623, "display_filter": "frame.number == 623", "timestamp_epoch": "1566329464.956482000" }, { "tcp_stream": 42, "frame_number": 625, "display_filter": "frame.number == 625", "timestamp_epoch": "1566329464.957250000" }, { "tcp_stream": 40, "frame_number": 627, "display_filter": "frame.number == 627", "timestamp_epoch": "1566329464.957927000" }, { "tcp_stream": 97, "frame_number": 9005, "display_filter": "frame.number == 9005", "timestamp_epoch": "1566330632.608814000" }, { "tcp_stream": 97, "frame_number": 9010, "display_filter": "frame.number == 9010", "timestamp_epoch": "1566330632.610263000" }, { "tcp_stream": 97, "frame_number": 9012, "display_filter": "frame.number == 9012", "timestamp_epoch": "1566330632.611554000" }, { "tcp_stream": 97, "frame_number": 9014, "display_filter": "frame.number == 9014", "timestamp_epoch": "1566330632.615018000" }, { "tcp_stream": 97, "frame_number": 9016, "display_filter": "frame.number == 9016", "timestamp_epoch": "1566330632.616319000" }, { "tcp_stream": 97, "frame_number": 9213, "display_filter": "frame.number == 9213", "timestamp_epoch": "1566330632.646869000" }, { "tcp_stream": 98, "frame_number": 9228, "display_filter": "frame.number == 9228", "timestamp_epoch": "1566330632.701634000" }, { "tcp_stream": 98, "frame_number": 9233, "display_filter": "frame.number == 9233", "timestamp_epoch": "1566330632.703184000" }, { "tcp_stream": 98, "frame_number": 9235, "display_filter": "frame.number == 9235", "timestamp_epoch": "1566330632.703821000" }, { "tcp_stream": 98, "frame_number": 9237, "display_filter": "frame.number == 9237", "timestamp_epoch": "1566330632.704292000" }, { "tcp_stream": 98, "frame_number": 9239, "display_filter": "frame.number == 9239", "timestamp_epoch": "1566330632.704741000" }, { "tcp_stream": 98, "frame_number": 9241, "display_filter": "frame.number == 9241", "timestamp_epoch": "1566330632.706995000" }, { "tcp_stream": 98, "frame_number": 9243, "display_filter": "frame.number == 9243", "timestamp_epoch": "1566330632.710742000" }, { "tcp_stream": 98, "frame_number": 9245, "display_filter": "frame.number == 9245", "timestamp_epoch": "1566330632.711310000" }, { "tcp_stream": 98, "frame_number": 9247, "display_filter": "frame.number == 9247", "timestamp_epoch": "1566330632.711632000" }, { "tcp_stream": 98, "frame_number": 9249, "display_filter": "frame.number == 9249", "timestamp_epoch": "1566330632.712205000" }, { "tcp_stream": 98, "frame_number": 9251, "display_filter": "frame.number == 9251", "timestamp_epoch": "1566330632.712833000" }, { "tcp_stream": 98, "frame_number": 9253, "display_filter": "frame.number == 9253", "timestamp_epoch": "1566330632.713399000" }, { "tcp_stream": 98, "frame_number": 9255, "display_filter": "frame.number == 9255", "timestamp_epoch": "1566330632.713817000" }, { "tcp_stream": 98, "frame_number": 9257, "display_filter": "frame.number == 9257", "timestamp_epoch": "1566330632.714602000" }, { "tcp_stream": 98, "frame_number": 9259, "display_filter": "frame.number == 9259", "timestamp_epoch": "1566330632.715242000" }, { "tcp_stream": 98, "frame_number": 9261, "display_filter": "frame.number == 9261", "timestamp_epoch": "1566330632.715535000" }, { "tcp_stream": 98, "frame_number": 9263, "display_filter": "frame.number == 9263", "timestamp_epoch": "1566330632.715834000" }, { "tcp_stream": 98, "frame_number": 9265, "display_filter": "frame.number == 9265", "timestamp_epoch": "1566330632.716351000" }, { "tcp_stream": 98, "frame_number": 9267, "display_filter": "frame.number == 9267", "timestamp_epoch": "1566330632.716932000" }, { "tcp_stream": 98, "frame_number": 9269, "display_filter": "frame.number == 9269", "timestamp_epoch": "1566330632.717523000" }, { "tcp_stream": 98, "frame_number": 9271, "display_filter": "frame.number == 9271", "timestamp_epoch": "1566330632.717964000" }, { "tcp_stream": 98, "frame_number": 9273, "display_filter": "frame.number == 9273", "timestamp_epoch": "1566330632.719313000" }, { "tcp_stream": 98, "frame_number": 9275, "display_filter": "frame.number == 9275", "timestamp_epoch": "1566330632.720008000" }, { "tcp_stream": 98, "frame_number": 9277, "display_filter": "frame.number == 9277", "timestamp_epoch": "1566330632.720352000" }, { "tcp_stream": 98, "frame_number": 9279, "display_filter": "frame.number == 9279", "timestamp_epoch": "1566330632.720730000" }, { "tcp_stream": 98, "frame_number": 9281, "display_filter": "frame.number == 9281", "timestamp_epoch": "1566330632.721286000" }, { "tcp_stream": 98, "frame_number": 9283, "display_filter": "frame.number == 9283", "timestamp_epoch": "1566330632.721979000" }, { "tcp_stream": 98, "frame_number": 9285, "display_filter": "frame.number == 9285", "timestamp_epoch": "1566330632.722275000" }, { "tcp_stream": 98, "frame_number": 9287, "display_filter": "frame.number == 9287", "timestamp_epoch": "1566330632.722558000" }, { "tcp_stream": 98, "frame_number": 9289, "display_filter": "frame.number == 9289", "timestamp_epoch": "1566330632.723050000" }, { "tcp_stream": 98, "frame_number": 9291, "display_filter": "frame.number == 9291", "timestamp_epoch": "1566330632.723615000" }, { "tcp_stream": 98, "frame_number": 9293, "display_filter": "frame.number == 9293", "timestamp_epoch": "1566330632.723899000" }, { "tcp_stream": 98, "frame_number": 9295, "display_filter": "frame.number == 9295", "timestamp_epoch": "1566330632.724203000" }, { "tcp_stream": 98, "frame_number": 9297, "display_filter": "frame.number == 9297", "timestamp_epoch": "1566330632.724728000" }, { "tcp_stream": 98, "frame_number": 9299, "display_filter": "frame.number == 9299", "timestamp_epoch": "1566330632.725306000" }, { "tcp_stream": 98, "frame_number": 9301, "display_filter": "frame.number == 9301", "timestamp_epoch": "1566330632.725581000" }, { "tcp_stream": 98, "frame_number": 9303, "display_filter": "frame.number == 9303", "timestamp_epoch": "1566330632.725872000" }, { "tcp_stream": 98, "frame_number": 9305, "display_filter": "frame.number == 9305", "timestamp_epoch": "1566330632.726359000" }, { "tcp_stream": 98, "frame_number": 9307, "display_filter": "frame.number == 9307", "timestamp_epoch": "1566330632.726898000" }, { "tcp_stream": 98, "frame_number": 9309, "display_filter": "frame.number == 9309", "timestamp_epoch": "1566330632.727222000" }, { "tcp_stream": 98, "frame_number": 9311, "display_filter": "frame.number == 9311", "timestamp_epoch": "1566330632.727501000" }, { "tcp_stream": 98, "frame_number": 9313, "display_filter": "frame.number == 9313", "timestamp_epoch": "1566330632.727966000" }, { "tcp_stream": 98, "frame_number": 9315, "display_filter": "frame.number == 9315", "timestamp_epoch": "1566330632.728524000" }, { "tcp_stream": 98, "frame_number": 9317, "display_filter": "frame.number == 9317", "timestamp_epoch": "1566330632.728811000" }, { "tcp_stream": 98, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1566330632.729130000" }, { "tcp_stream": 98, "frame_number": 9321, "display_filter": "frame.number == 9321", "timestamp_epoch": "1566330632.729664000" }, { "tcp_stream": 98, "frame_number": 9323, "display_filter": "frame.number == 9323", "timestamp_epoch": "1566330632.730234000" }, { "tcp_stream": 98, "frame_number": 9325, "display_filter": "frame.number == 9325", "timestamp_epoch": "1566330632.730503000" }, { "tcp_stream": 98, "frame_number": 9327, "display_filter": "frame.number == 9327", "timestamp_epoch": "1566330632.730800000" }, { "tcp_stream": 98, "frame_number": 9329, "display_filter": "frame.number == 9329", "timestamp_epoch": "1566330632.731271000" }, { "tcp_stream": 98, "frame_number": 9331, "display_filter": "frame.number == 9331", "timestamp_epoch": "1566330632.731812000" }, { "tcp_stream": 98, "frame_number": 9333, "display_filter": "frame.number == 9333", "timestamp_epoch": "1566330632.732077000" }, { "tcp_stream": 98, "frame_number": 9335, "display_filter": "frame.number == 9335", "timestamp_epoch": "1566330632.732353000" }, { "tcp_stream": 98, "frame_number": 9337, "display_filter": "frame.number == 9337", "timestamp_epoch": "1566330632.732812000" }, { "tcp_stream": 98, "frame_number": 9339, "display_filter": "frame.number == 9339", "timestamp_epoch": "1566330632.733341000" }, { "tcp_stream": 98, "frame_number": 9341, "display_filter": "frame.number == 9341", "timestamp_epoch": "1566330632.733613000" }, { "tcp_stream": 98, "frame_number": 9343, "display_filter": "frame.number == 9343", "timestamp_epoch": "1566330632.733946000" }, { "tcp_stream": 98, "frame_number": 9345, "display_filter": "frame.number == 9345", "timestamp_epoch": "1566330632.734440000" }, { "tcp_stream": 98, "frame_number": 9347, "display_filter": "frame.number == 9347", "timestamp_epoch": "1566330632.735296000" }, { "tcp_stream": 98, "frame_number": 9349, "display_filter": "frame.number == 9349", "timestamp_epoch": "1566330632.735719000" }, { "tcp_stream": 98, "frame_number": 9351, "display_filter": "frame.number == 9351", "timestamp_epoch": "1566330632.736053000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-ae125415cf9a58fec8e94944", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Credential-shaped records in a cleartext HTTP request", "status": "candidate", "metrics": { "source": "10.8.20.101", "body_sha256": "351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15", "destination": "170.238.117.187", "body_size_bytes": 259, "secrets_redacted": true }, "rule_id": "sensitive-data-in-cleartext", "evidence": [ { "tcp_stream": 87, "frame_number": 7772, "display_filter": "frame.number == 7772", "timestamp_epoch": "1566330622.260866000" } ], "severity": "high", "confidence": 0.95, "finding_id": "finding-09183bb881ce24b3835e0d8f", "explanation": "The decoded request body contains a credential-record structure or private-key marker. Values are redacted from derived evidence. This proves transmission of the observed structure, not that a credential is valid or how it was obtained.", "rule_version": "pcap-rules-v5" }, { "title": "System-inventory structure transmitted in HTTP body", "status": "candidate", "metrics": { "source": "10.8.20.101", "body_sha256": "30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844", "destination": "170.238.117.187", "claimed_identities": [ { "type": "hostname", "value": "Tampa-Office-PC", "source": "explicit-body-label" }, { "type": "account", "value": "reginald.chandler", "source": "explicit-body-label" } ] }, "rule_id": "system-inventory-upload", "evidence": [ { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" } ], "severity": "medium", "confidence": 0.9, "finding_id": "finding-fc8e7fd79c53c42943310a52", "explanation": "A request body contains process/system inventory markers and may include host/account assertions. This is network-observed transmission, not proof of the commands having executed on that host.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "484c8b2d9c49ad07cf2f08587f515181", "sha1": "23dbcd2f06cd48296d8e8f5edffa0132e0900b2d", "type": "http-exported-object", "sha256": "9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345", "evidence": [ { "tcp_stream": 88, "frame_number": 8566, "display_filter": "frame.number == 8566", "timestamp_epoch": "1566330625.679780000" } ], "filename": "tablone.png", "filenames": [ "tablone.png" ], "transfers": [ { "url": "http://185.183.98.232/tablone.png", "client_ip": "10.8.20.101", "server_ip": "185.183.98.232", "tcp_stream": 88, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7765, "response_frame": 8566 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 845312, "artifact_id": "artifact-cb85ff6cff4451bcfbb76fd3", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7c96f51b36d5d2b747531713bc4c4b3d", "sha1": "9b6e9c84e918dad5e2799912a6f971be01eb6f25", "type": "http-exported-object", "sha256": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "evidence": [ { "tcp_stream": 82, "frame_number": 6851, "display_filter": "frame.number == 6851", "timestamp_epoch": "1566330600.629265000" }, { "tcp_stream": 141, "frame_number": 17479, "display_filter": "frame.number == 17479", "timestamp_epoch": "1566330835.032932000" } ], "filename": "samerton(1).png", "filenames": [ "samerton(1).png", "samerton.png" ], "transfers": [ { "url": "http://185.183.98.232/samerton.png", "client_ip": "10.8.20.101", "server_ip": "185.183.98.232", "tcp_stream": 82, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6112, "response_frame": 6851 }, { "url": "http://185.183.98.232/samerton.png", "client_ip": "10.8.20.101", "server_ip": "185.183.98.232", "tcp_stream": 141, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 16701, "response_frame": 17479 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 845312, "artifact_id": "artifact-a709cdf7664add74a5670a6c", "occurrences": 2, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2356b5471a1c4825b459193c7189d356", "sha1": "a03e6446e4d9e98eebca4f6a9b1487457543d584", "type": "http-exported-object", "sha256": "e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224", "evidence": [ { "tcp_stream": 123, "frame_number": 11294, "display_filter": "frame.number == 11294", "timestamp_epoch": "1566330660.443490000" } ], "filename": "wredneg2.png", "filenames": [ "wredneg2.png" ], "transfers": [ { "url": "http://185.183.98.232/wredneg2.png", "client_ip": "10.8.20.101", "server_ip": "185.183.98.232", "tcp_stream": 123, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 10374, "response_frame": 11294 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 842240, "artifact_id": "artifact-c57ae597edfeec3101feee66", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "af442fcdcf8d2967ec463d92a25f7ac8", "sha1": "db910469f6cd5a6b1d08f681b1559005929ae30d", "type": "http-exported-object", "sha256": "4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc", "evidence": [ { "tcp_stream": 44, "frame_number": 1230, "display_filter": "frame.number == 1230", "timestamp_epoch": "1566329496.242564000" } ], "filename": "ttqr.php%3fl=csuv3.j12", "filenames": [ "ttqr.php%3fl=csuv3.j12" ], "transfers": [ { "url": "http://bh79sbu.com/qtra/ttqr.php?l=csuv3.j12", "client_ip": "10.8.20.101", "server_ip": "94.103.87.160", "tcp_stream": 44, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 687, "response_frame": 1230 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 551936, "artifact_id": "artifact-6fb80bffe6c8b5c27272bde0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "dcee3bf1c38e4de196c549d7bbfb63ce", "sha1": "7cbcd3753830d6878c5851c2f1e05977afea7446", "type": "http-exported-object", "sha256": "9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc", "evidence": [ { "tcp_stream": 130, "frame_number": 13445, "display_filter": "frame.number == 13445", "timestamp_epoch": "1566330706.025314000" } ], "filename": "antifreeze.rar", "filenames": [ "antifreeze.rar" ], "transfers": [ { "url": "http://boozzdigital.com/wp-content/uploads/2019/08/antifreeze.rar", "client_ip": "10.8.20.101", "server_ip": "68.183.185.221", "tcp_stream": 130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 12669, "response_frame": 13445 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 753229, "artifact_id": "artifact-8cc91e4994fefa1e34ca8f95", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8a8116b168bb326251d080024bf01841", "sha1": "bb2123d29a2394e2e4a5649dff43ad6f23a94d10", "type": "http-exported-object", "sha256": "edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437", "evidence": [ { "tcp_stream": 58, "frame_number": 1951, "display_filter": "frame.number == 1951", "timestamp_epoch": "1566329726.954648000" } ], "filename": "lux.avi", "filenames": [ "lux.avi" ], "transfers": [ { "url": "http://hne53brianaea.com/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi", "client_ip": "10.8.20.101", "server_ip": "94.103.86.146", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1688, "response_frame": 1951 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 275200, "artifact_id": "artifact-fe5b17629bee7a20e82e9ef7", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "6c23e6a08e21ba228a7c0aad0d19e985", "sha1": "858bc7efcf43d9bac7c05f80bf49e31e7c05d081", "type": "http-exported-object", "sha256": "e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1", "evidence": [ { "tcp_stream": 58, "frame_number": 1678, "display_filter": "frame.number == 1678", "timestamp_epoch": "1566329725.084605000" } ], "filename": "z.avi", "filenames": [ "z.avi" ], "transfers": [ { "url": "http://hne53brianaea.com/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi", "client_ip": "10.8.20.101", "server_ip": "94.103.86.146", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1452, "response_frame": 1678 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 218540, "artifact_id": "artifact-d2faa0340c525a0c5be59127", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 218540, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 218540, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "58a3badc25e15583224e2b922f370a4f", "sha1": "5dcce1d09a846eea3d78ebea95fd8da9dcc8b61c", "type": "http-exported-object", "sha256": "7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a", "evidence": [ { "tcp_stream": 62, "frame_number": 2082, "display_filter": "frame.number == 2082", "timestamp_epoch": "1566329807.630719000" } ], "filename": "authrootstl.cab", "filenames": [ "authrootstl.cab" ], "transfers": [ { "url": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "client_ip": "10.8.20.101", "server_ip": "23.200.143.72", "tcp_stream": 62, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 2029, "response_frame": 2082 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 58000, "artifact_id": "artifact-7780a9f3dce1d43e956a8b28", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 58000, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 58000, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "4c9acf280b47cef7def3fc91a34c7ffe", "sha1": "c32bb847daf52117ab93b723d7c57d8b1e75d36b", "type": "http-exported-object", "sha256": "5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7", "evidence": [ { "tcp_stream": 52, "frame_number": 1354, "display_filter": "frame.number == 1354", "timestamp_epoch": "1566329681.691653000" } ], "filename": "robot.png", "filenames": [ "robot.png" ], "transfers": [ { "url": "http://www.google.com/images/errors/robot.png", "client_ip": "10.8.20.101", "server_ip": "172.217.9.132", "tcp_stream": 52, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1347, "response_frame": 1354 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 6327, "artifact_id": "artifact-00efde5a7b900f4b77d059f8", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 6327, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 6327, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f74755b4757448d71fdcb4650a701816", "sha1": "0bcbe73d6a198f6e5ebafa035b734a12809cefa6", "type": "http-exported-object", "sha256": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "evidence": [ { "tcp_stream": 58, "frame_number": 1685, "display_filter": "frame.number == 1685", "timestamp_epoch": "1566329725.263153000" } ], "filename": "favicon.ico", "filenames": [ "favicon.ico" ], "transfers": [ { "url": "http://hne53brianaea.com/favicon.ico", "client_ip": "10.8.20.101", "server_ip": "94.103.86.146", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1680, "response_frame": 1685 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/vnd.microsoft.icon", "size_bytes": 5430, "artifact_id": "artifact-7e4812df6b922e2412d9c718", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 5430, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 5430, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0a444aba2d48f39c2b2da1ca28d76410", "sha1": "bc1063379e95064c7bdc092e00dee2d00fc01517", "type": "http-exported-object", "sha256": "30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844", "evidence": [], "filename": "90", "filenames": [ "90" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 4575, "artifact_id": "artifact-08e7d9c7096cba0ddcbecb34", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 4575, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9d73b3aa30bce9d8f166de5178ae4338", "sha1": "d0cbc46850d8ed54625a3b2b01a2c31f37977e75", "type": "http-exported-object", "sha256": "dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139", "evidence": [ { "tcp_stream": 51, "frame_number": 1358, "display_filter": "frame.number == 1358", "timestamp_epoch": "1566329681.695896000" } ], "filename": "googlelogo_color_150x54dp.png", "filenames": [ "googlelogo_color_150x54dp.png" ], "transfers": [ { "url": "http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png", "client_ip": "10.8.20.101", "server_ip": "172.217.9.132", "tcp_stream": 51, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1345, "response_frame": 1358 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 3170, "artifact_id": "artifact-62c5f30438e2343894f28b0a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3170, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3170, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "00587851b1c3a74af7b8a15173092d8d", "sha1": "d706d4b64a8c08652b122915b8f0e5fec83e4b94", "type": "http-exported-object", "sha256": "f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93", "evidence": [ { "tcp_stream": 58, "frame_number": 1957, "display_filter": "frame.number == 1957", "timestamp_epoch": "1566329728.132316000" } ], "filename": "L.avi", "filenames": [ "L.avi" ], "transfers": [ { "url": "http://hne53brianaea.com/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi", "client_ip": "10.8.20.101", "server_ip": "94.103.86.146", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1954, "response_frame": 1957 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 2372, "artifact_id": "artifact-88768648f6fa824b7c76678a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2372, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2372, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "650747e56a2c645c7ba1d553512bd389", "sha1": "53f814e226c360b1e7c279a39c54297c45c59533", "type": "http-exported-object", "sha256": "5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953", "evidence": [], "filename": "90(2)", "filenames": [ "90(2)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2098, "artifact_id": "artifact-b6f5b6d1dc4b46f75ab3d3ce", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2098, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a9e73a5589905bb3f79e05ef86bfcef0", "sha1": "6576521c61536e9c1dec5e5466e9faa748c9f802", "type": "http-exported-object", "sha256": "b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23", "evidence": [ { "tcp_stream": 50, "frame_number": 1334, "display_filter": "frame.number == 1334", "timestamp_epoch": "1566329681.545978000" } ], "filename": "5.avi", "filenames": [ "5.avi" ], "transfers": [ { "url": "http://google.com/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi", "client_ip": "10.8.20.101", "server_ip": "172.217.6.174", "tcp_stream": 50, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "404", "completeness": "matches-declared-content-length", "request_frame": 1331, "response_frame": 1334 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "video/x-msvideo", "size_bytes": 1743, "artifact_id": "artifact-98d17abaccc99b77b0484c37", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1743, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1743, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "192d38157667d5c0348c7194f9175830", "sha1": "618c39c8efeeb88dc3ca564921104c89e1b79462", "type": "http-exported-object", "sha256": "218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30", "evidence": [], "filename": "83", "filenames": [ "83" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 320, "artifact_id": "artifact-c7ba2deb069c30e3c9755f1a", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 320, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5797865257cd14f09d01b9ad1eb01a1c", "sha1": "f306e7c172eac47139c960ddc55a5564754fea03", "type": "http-exported-object", "sha256": "ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb", "evidence": [ { "tcp_stream": 72, "frame_number": 3253, "display_filter": "frame.number == 3253", "timestamp_epoch": "1566330403.446640000" } ], "filename": "3antifreeze.rar", "filenames": [ "3antifreeze.rar" ], "transfers": [ { "url": "http://idogoiania.com.br/wp-content/uploads/2019/08/3antifreeze.rar", "client_ip": "10.8.20.101", "server_ip": "206.189.74.47", "tcp_stream": 72, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "301", "completeness": "matches-declared-content-length", "request_frame": 3251, "response_frame": 3253 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 276, "artifact_id": "artifact-a750aeffcb5541ca141e809c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 276, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 276, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5ff02e22ab7c05ab17f92097896c6cf5", "sha1": "14b964a11978e33d3f955e348039e2abb341f873", "type": "http-exported-object", "sha256": "df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742", "evidence": [], "filename": "81", "filenames": [ "81" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 271, "artifact_id": "artifact-a7eb04848e18ccec9b412cf6", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 271, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a9680e363adbc052ce81e9918410016f", "sha1": "ca63c09f2648f07469a4fe97d635fa9a01cfba4b", "type": "http-exported-object", "sha256": "351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15", "evidence": [], "filename": "81(2)", "filenames": [ "81(2)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 259, "artifact_id": "artifact-df02c7820d0d29cdb38e4e80", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 259, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cd5a4d3fdd5bffc16bf959ef75cf37bc", "sha1": "33bf88d5b82df3723d5863c7d23445e345828904", "type": "http-exported-object", "sha256": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [ { "tcp_stream": 27, "frame_number": 415, "display_filter": "frame.number == 415", "timestamp_epoch": "1566329455.768270000" } ], "filename": "ncsi.txt", "filenames": [ "ncsi.txt" ], "transfers": [ { "url": "http://www.msftncsi.com/ncsi.txt", "client_ip": "10.8.20.101", "server_ip": "63.239.233.90", "tcp_stream": 27, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 413, "response_frame": 415 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/plain", "size_bytes": 14, "artifact_id": "artifact-d25e91f6eefd55494512e8b6", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 14, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 14, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fa06d89c65fb808240e37f4c9e128955", "sha1": "ff0288c119791fc13a51965eb3a0e61be2c06338", "type": "http-exported-object", "sha256": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [ { "tcp_stream": 85, "frame_number": 6927, "display_filter": "frame.number == 6927", "timestamp_epoch": "1566330617.342323000" }, { "tcp_stream": 86, "frame_number": 7743, "display_filter": "frame.number == 7743", "timestamp_epoch": "1566330619.789679000" }, { "tcp_stream": 87, "frame_number": 7860, "display_filter": "frame.number == 7860", "timestamp_epoch": "1566330622.819462000" }, { "tcp_stream": 99, "frame_number": 9420, "display_filter": "frame.number == 9420", "timestamp_epoch": "1566330633.723877000" }, { "tcp_stream": 152, "frame_number": 18249, "display_filter": "frame.number == 18249", "timestamp_epoch": "1566331171.972242000" } ], "filename": "81(1)", "filenames": [ "81(1)", "81(3)", "83(1)", "90(1)", "90(3)" ], "transfers": [ { "url": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/", "client_ip": "10.8.20.101", "server_ip": "170.238.117.187", "tcp_stream": 85, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6923, "response_frame": 6927 }, { "url": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/", "client_ip": "10.8.20.101", "server_ip": "170.238.117.187", "tcp_stream": 86, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7165, "response_frame": 7743 }, { "url": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/", "client_ip": "10.8.20.101", "server_ip": "170.238.117.187", "tcp_stream": 87, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7772, "response_frame": 7860 }, { "url": "http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90", "client_ip": "10.8.20.101", "server_ip": "170.238.117.187", "tcp_stream": 99, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 9414, "response_frame": 9420 }, { "url": "http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90", "client_ip": "10.8.20.101", "server_ip": "170.238.117.187", "tcp_stream": 152, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 18243, "response_frame": 18249 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3, "artifact_id": "artifact-11004bc8face1508f4c72915", "occurrences": 5, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.8.20.1", "bytes_sent": 108, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-50ddfb0964cdd9bd1941cc36", "packets_sent": 2, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 132, "evidence_frames": [ 8567, 8568, 8721, 8722 ], "last_seen_epoch": "1566330626.194663", "first_seen_epoch": "1566330625.689313", "packets_received": 2 }, { "ip": "10.8.20.101", "bytes_sent": 1502169, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-b159e57bf4548f01d33fa30f", "packets_sent": 7489, "mac_addresses": [ "00:18:f3:a6:01:92" ], "bytes_received": 11439473, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1566331716.733467", "first_seen_epoch": "1566329449.865545", "packets_received": 11454 }, { "ip": "10.8.20.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-efd395171d57a1912559ae32", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 16280, "evidence_frames": [ 1, 2, 188, 255, 256 ], "last_seen_epoch": "1566331166.351293", "first_seen_epoch": "1566329449.865545", "packets_received": 118 }, { "ip": "10.8.20.8", "bytes_sent": 1066302, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-41f3f483d59a3ddeb89945e4", "packets_sent": 3749, "mac_addresses": [ "a4:1f:72:c2:09:6a" ], "bytes_received": 1138348, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1566331707.347774", "first_seen_epoch": "1566329449.877162", "packets_received": 4091 }, { "ip": "139.198.5.65", "bytes_sent": 861177, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b046295773448d38d87b497c", "packets_sent": 608, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 14076, "evidence_frames": [ 2135, 2136, 2137, 2138, 2139 ], "last_seen_epoch": "1566330101.749095", "first_seen_epoch": "1566330099.302355", "packets_received": 245 }, { "ip": "170.238.117.187", "bytes_sent": 2351, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-24108225fe4c6e27a88d06d5", "packets_sent": 31, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 11275, "evidence_frames": [ 6918, 6919, 6920, 6921, 6922 ], "last_seen_epoch": "1566331284.830924", "first_seen_epoch": "1566330616.40594", "packets_received": 36 }, { "ip": "172.217.6.133", "bytes_sent": 14043, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-daa74773bd44f4b8bf6e096b", "packets_sent": 26, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3389, "evidence_frames": [ 1369, 1370, 1371, 1372, 1373 ], "last_seen_epoch": "1566329914.810994", "first_seen_epoch": "1566329702.710994", "packets_received": 28 }, { "ip": "172.217.6.174", "bytes_sent": 8434, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3fc9ddd3c238be93c26018df", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2814, "evidence_frames": [ 1325, 1326, 1327, 1328, 1329 ], "last_seen_epoch": "1566329914.833249", "first_seen_epoch": "1566329681.509747", "packets_received": 19 }, { "ip": "172.217.9.132", "bytes_sent": 27328, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c3b15d2f044f33d42fda8292", "packets_sent": 34, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5402, "evidence_frames": [ 1339, 1340, 1341, 1342, 1343 ], "last_seen_epoch": "1566329703.752902", "first_seen_epoch": "1566329681.650029", "packets_received": 29 }, { "ip": "185.117.75.41", "bytes_sent": 2908012, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-af371a65a6bb4d696b164ed0", "packets_sent": 1974, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 38329, "evidence_frames": [ 4065, 4066, 4067, 4068, 4069 ], "last_seen_epoch": "1566331701.94571", "first_seen_epoch": "1566330548.87944", "packets_received": 639 }, { "ip": "185.183.98.232", "bytes_sent": 3506065, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-550329a73596267e871a9196", "packets_sent": 2350, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 37653, "evidence_frames": [ 6109, 6110, 6111, 6112, 6113 ], "last_seen_epoch": "1566330895.022174", "first_seen_epoch": "1566330597.1238", "packets_received": 688 }, { "ip": "185.193.141.166", "bytes_sent": 34798, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-28ca1bd834523184e59964dc", "packets_sent": 171, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 31007, "evidence_frames": [ 2013, 2014, 2015, 2016, 2017 ], "last_seen_epoch": "1566331674.423538", "first_seen_epoch": "1566329806.729474", "packets_received": 199 }, { "ip": "185.248.87.88", "bytes_sent": 5807, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bcf107fdec1288239f6cc3da", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1086, "evidence_frames": [ 3002, 3004, 3005, 3006, 3007 ], "last_seen_epoch": "1566330133.56399", "first_seen_epoch": "1566330133.358851", "packets_received": 10 }, { "ip": "185.70.40.151", "bytes_sent": 50518, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-492b10b7843c40ef85fa63ab", "packets_sent": 82, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 12855, "evidence_frames": [ 18573, 18576, 18577, 18581, 18582 ], "last_seen_epoch": "1566331716.733467", "first_seen_epoch": "1566331706.357985", "packets_received": 66 }, { "ip": "191.37.181.152", "bytes_sent": 7067, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e2e1240c50a8b6c8e83a3b94", "packets_sent": 23, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3513, "evidence_frames": [ 2988, 2989, 2990, 2991, 2992 ], "last_seen_epoch": "1566330205.294049", "first_seen_epoch": "1566330131.331841", "packets_received": 16 }, { "ip": "192.185.170.206", "bytes_sent": 184, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a9ef4a85cca4103401eac5f9", "packets_sent": 2, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 0, "evidence_frames": [ 1298, 2117 ], "last_seen_epoch": "1566330083.6636", "first_seen_epoch": "1566329572.334535", "packets_received": 0 }, { "ip": "192.252.210.19", "bytes_sent": 220, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-feb2ff6ca3a0c720aafe1541", "packets_sent": 4, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 291, "evidence_frames": [ 18491, 18493, 18494, 18495, 18514 ], "last_seen_epoch": "1566331701.721003", "first_seen_epoch": "1566331676.653621", "packets_received": 4 }, { "ip": "206.189.74.47", "bytes_sent": 790243, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-86c8170e72cc67e684a5211b", "packets_sent": 538, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 13988, "evidence_frames": [ 3248, 3249, 3250, 3251, 3252 ], "last_seen_epoch": "1566330509.707726", "first_seen_epoch": "1566330403.345053", "packets_received": 240 }, { "ip": "208.67.222.222", "bytes_sent": 374, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9376a80a8cf95faf2ac7f636", "packets_sent": 3, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 252, "evidence_frames": [ 1965, 1966, 1967, 1968, 1969 ], "last_seen_epoch": "1566329796.306864", "first_seen_epoch": "1566329796.096059", "packets_received": 3 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c8a5365ec9d3824a77601c04", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 540, "evidence_frames": [ 15, 16, 109, 379, 380 ], "last_seen_epoch": "1566329570.601853", "first_seen_epoch": "1566329449.919978", "packets_received": 10 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-83276377a63760debc69ffff", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 834, "evidence_frames": [ 17, 25, 381, 384, 385 ], "last_seen_epoch": "1566330632.886808", "first_seen_epoch": "1566329449.920576", "packets_received": 12 }, { "ip": "23.200.143.72", "bytes_sent": 60676, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6c4766346f9cb8043072ae80", "packets_sent": 43, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1093, "evidence_frames": [ 2026, 2027, 2028, 2029, 2030 ], "last_seen_epoch": "1566329867.63827", "first_seen_epoch": "1566329807.576146", "packets_received": 16 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e06911328de6798e1e07ffaf", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 1050, "evidence_frames": [ 1287, 1297, 1299, 1300, 1301 ], "last_seen_epoch": "1566329576.873927", "first_seen_epoch": "1566329570.525266", "packets_received": 6 }, { "ip": "5.39.113.142", "bytes_sent": 16045, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-190ab059ba2912c903817cab", "packets_sent": 116, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 52917, "evidence_frames": [ 18546, 18547, 18548, 18549, 18558 ], "last_seen_epoch": "1566331716.7082", "first_seen_epoch": "1566331702.897389", "packets_received": 115 }, { "ip": "63.239.233.90", "bytes_sent": 399, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ea26fc6219e6529916907e8c", "packets_sent": 4, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 379, "evidence_frames": [ 410, 411, 412, 413, 414 ], "last_seen_epoch": "1566329455.768866", "first_seen_epoch": "1566329455.715947", "packets_received": 5 }, { "ip": "68.183.185.221", "bytes_sent": 781879, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3a5950c818bb6061243c860f", "packets_sent": 525, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 14368, "evidence_frames": [ 12666, 12667, 12668, 12669, 12670 ], "last_seen_epoch": "1566330736.554673", "first_seen_epoch": "1566330702.51451", "packets_received": 262 }, { "ip": "89.105.203.184", "bytes_sent": 201809, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-86bf5fd65e671c45ff5f4b18", "packets_sent": 399, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 81147, "evidence_frames": [ 3046, 3047, 3048, 3049, 3050 ], "last_seen_epoch": "1566331707.920551", "first_seen_epoch": "1566330143.254969", "packets_received": 307 }, { "ip": "94.103.86.146", "bytes_sent": 522556, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c96538df61bd8c85a4d230a5", "packets_sent": 355, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 10143, "evidence_frames": [ 1446, 1447, 1448, 1449, 1450 ], "last_seen_epoch": "1566329728.995839", "first_seen_epoch": "1566329723.984034", "packets_received": 158 }, { "ip": "94.103.87.160", "bytes_sent": 573078, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d7c9b1bcf38afbc68cd113ae", "packets_sent": 385, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9008, "evidence_frames": [ 684, 685, 686, 687, 688 ], "last_seen_epoch": "1566329496.252813", "first_seen_epoch": "1566329493.58186", "packets_received": 165 } ], "identities": [ { "type": "account", "value": "reginald.chandler", "bindings": [ { "account": "", "owner_ip": "10.8.20.101", "frame_number": 490, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 498, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 500, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 512, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 526, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 559, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 571, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 604, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "owner_ip": "10.8.20.101", "frame_number": 9414, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "170.238.117.187", "conversation_src": "10.8.20.101" } ], "evidence": [ { "tcp_stream": 33, "frame_number": 490, "display_filter": "frame.number == 490", "timestamp_epoch": "1566329464.349898000" }, { "tcp_stream": 34, "frame_number": 498, "display_filter": "frame.number == 498", "timestamp_epoch": "1566329464.373469000" }, { "tcp_stream": 34, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1566329464.374659000" }, { "tcp_stream": 35, "frame_number": 512, "display_filter": "frame.number == 512", "timestamp_epoch": "1566329464.376545000" }, { "tcp_stream": 36, "frame_number": 526, "display_filter": "frame.number == 526", "timestamp_epoch": "1566329464.417621000" }, { "tcp_stream": 38, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1566329464.458208000" }, { "tcp_stream": 39, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1566329464.459752000" }, { "tcp_stream": 41, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1566329464.948387000" }, { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" } ], "raw_values": [ "reginald.chandler" ], "identity_id": "identity-1f57e667c153388d15668bf5", "ip_addresses": [ "10.8.20.101" ], "mac_addresses": [ "00:18:f3:a6:01:92" ] }, { "type": "account", "value": "tampa-office-pc$", "bindings": [ { "account": "", "owner_ip": "10.8.20.101", "frame_number": 51, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 59, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 62, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 77, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 102, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 113, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 115, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 127, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 136, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 163, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 236, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 283, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 295, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 335, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 344, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 454, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 462, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 464, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 476, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.8.20.101", "conversation_src": "10.8.20.8" } ], "evidence": [ { "tcp_stream": 3, "frame_number": 51, "display_filter": "frame.number == 51", "timestamp_epoch": "1566329450.046833000" }, { "tcp_stream": 4, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1566329450.067873000" }, { "tcp_stream": 4, "frame_number": 62, "display_filter": "frame.number == 62", "timestamp_epoch": "1566329450.068683000" }, { "tcp_stream": 5, "frame_number": 77, "display_filter": "frame.number == 77", "timestamp_epoch": "1566329450.074033000" }, { "tcp_stream": 7, "frame_number": 102, "display_filter": "frame.number == 102", "timestamp_epoch": "1566329450.079112000" }, { "tcp_stream": 8, "frame_number": 113, "display_filter": "frame.number == 113", "timestamp_epoch": "1566329450.100891000" }, { "tcp_stream": 8, "frame_number": 115, "display_filter": "frame.number == 115", "timestamp_epoch": "1566329450.101818000" }, { "tcp_stream": 9, "frame_number": 127, "display_filter": "frame.number == 127", "timestamp_epoch": "1566329450.106023000" }, { "tcp_stream": 10, "frame_number": 136, "display_filter": "frame.number == 136", "timestamp_epoch": "1566329450.107229000" }, { "tcp_stream": 12, "frame_number": 163, "display_filter": "frame.number == 163", "timestamp_epoch": "1566329450.181431000" }, { "tcp_stream": 18, "frame_number": 236, "display_filter": "frame.number == 236", "timestamp_epoch": "1566329450.540914000" }, { "tcp_stream": 20, "frame_number": 283, "display_filter": "frame.number == 283", "timestamp_epoch": "1566329451.133410000" }, { "tcp_stream": 21, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1566329451.137858000" }, { "tcp_stream": 25, "frame_number": 335, "display_filter": "frame.number == 335", "timestamp_epoch": "1566329451.147264000" }, { "tcp_stream": 26, "frame_number": 344, "display_filter": "frame.number == 344", "timestamp_epoch": "1566329451.148554000" }, { "tcp_stream": 30, "frame_number": 454, "display_filter": "frame.number == 454", "timestamp_epoch": "1566329460.838113000" }, { "tcp_stream": 31, "frame_number": 462, "display_filter": "frame.number == 462", "timestamp_epoch": "1566329460.855376000" }, { "tcp_stream": 31, "frame_number": 464, "display_filter": "frame.number == 464", "timestamp_epoch": "1566329460.856333000" }, { "tcp_stream": 32, "frame_number": 476, "display_filter": "frame.number == 476", "timestamp_epoch": "1566329460.858271000" } ], "raw_values": [ "TAMPA-OFFICE-PC$", "tampa-office-pc$" ], "identity_id": "identity-baa8adc17b23b8d02485e076", "ip_addresses": [ "10.8.20.101" ], "mac_addresses": [ "00:18:f3:a6:01:92" ] }, { "type": "domain", "value": "BADBUNDT", "bindings": [ { "account": "", "owner_ip": "10.8.20.101", "frame_number": 8826, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 10485, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 11839, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 11858, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 12067, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 12531, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 13649, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 14314, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 14879, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 15501, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 15520, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 15848, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 16467, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 16680, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.8.20.8", "conversation_src": "10.8.20.101" } ], "evidence": [ { "tcp_stream": 94, "frame_number": 8826, "display_filter": "frame.number == 8826", "timestamp_epoch": "1566330630.930734000" }, { "tcp_stream": 124, "frame_number": 10485, "display_filter": "frame.number == 10485", "timestamp_epoch": "1566330656.181668000" }, { "tcp_stream": 125, "frame_number": 11839, "display_filter": "frame.number == 11839", "timestamp_epoch": "1566330681.439029000" }, { "tcp_stream": 126, "frame_number": 11858, "display_filter": "frame.number == 11858", "timestamp_epoch": "1566330681.442165000" }, { "tcp_stream": 127, "frame_number": 12067, "display_filter": "frame.number == 12067", "timestamp_epoch": "1566330686.672321000" }, { "tcp_stream": 129, "frame_number": 12531, "display_filter": "frame.number == 12531", "timestamp_epoch": "1566330701.914327000" }, { "tcp_stream": 131, "frame_number": 13649, "display_filter": "frame.number == 13649", "timestamp_epoch": "1566330712.145486000" }, { "tcp_stream": 134, "frame_number": 14314, "display_filter": "frame.number == 14314", "timestamp_epoch": "1566330737.383481000" }, { "tcp_stream": 135, "frame_number": 14879, "display_filter": "frame.number == 14879", "timestamp_epoch": "1566330757.621864000" }, { "tcp_stream": 136, "frame_number": 15501, "display_filter": "frame.number == 15501", "timestamp_epoch": "1566330782.873142000" }, { "tcp_stream": 137, "frame_number": 15520, "display_filter": "frame.number == 15520", "timestamp_epoch": "1566330782.875967000" }, { "tcp_stream": 138, "frame_number": 15848, "display_filter": "frame.number == 15848", "timestamp_epoch": "1566330793.111525000" }, { "tcp_stream": 139, "frame_number": 16467, "display_filter": "frame.number == 16467", "timestamp_epoch": "1566330823.373133000" }, { "tcp_stream": 140, "frame_number": 16680, "display_filter": "frame.number == 16680", "timestamp_epoch": "1566330828.600540000" } ], "raw_values": [ "BADBUNDT" ], "identity_id": "identity-17bc2b1264fd6f506900d560", "ip_addresses": [ "10.8.20.101" ], "mac_addresses": [ "00:18:f3:a6:01:92" ] }, { "type": "hostname", "value": "TAMPA-OFFICE-PC", "bindings": [ { "account": "", "owner_ip": "10.8.20.101", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 188, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 256, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 260, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 369, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 375, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 377, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": "10.8.20.101", "frame_number": 378, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "owner_ip": "10.8.20.101", "frame_number": 9414, "relationship": "body-asserted-not-authenticated", "source_field": "explicit-body-label", "conversation_dst": "170.238.117.187", "conversation_src": "10.8.20.101" } ], "evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1566329449.865545000" }, { "udp_stream": 0, "frame_number": 188, "display_filter": "frame.number == 188", "timestamp_epoch": "1566329450.202042000" }, { "udp_stream": 0, "frame_number": 256, "display_filter": "frame.number == 256", "timestamp_epoch": "1566329450.616241000" }, { "udp_stream": 0, "frame_number": 260, "display_filter": "frame.number == 260", "timestamp_epoch": "1566329450.956222000" }, { "udp_stream": 0, "frame_number": 369, "display_filter": "frame.number == 369", "timestamp_epoch": "1566329451.367214000" }, { "udp_stream": 0, "frame_number": 375, "display_filter": "frame.number == 375", "timestamp_epoch": "1566329451.705838000" }, { "udp_stream": 0, "frame_number": 377, "display_filter": "frame.number == 377", "timestamp_epoch": "1566329452.116713000" }, { "udp_stream": 0, "frame_number": 378, "display_filter": "frame.number == 378", "timestamp_epoch": "1566329452.455823000" }, { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" } ], "raw_values": [ "TAMPA-OFFICE-PC<00>,TAMPA-OFFICE-PC<00> (Workstation/Redirector)", "TAMPA-OFFICE-PC<20>,TAMPA-OFFICE-PC<20> (Server service)", "Tampa-Office-PC" ], "identity_id": "identity-13e940cee94ca079dee1650d", "ip_addresses": [ "10.8.20.101" ], "mac_addresses": [ "00:18:f3:a6:01:92" ] }, { "type": "netbios-group", "value": "BADBUNDT", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": null, "frame_number": 255, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": null, "frame_number": 370, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" }, { "account": "", "owner_ip": null, "frame_number": 376, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.8.20.255", "conversation_src": "10.8.20.101" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1566329449.865877000" }, { "udp_stream": 0, "frame_number": 255, "display_filter": "frame.number == 255", "timestamp_epoch": "1566329450.616091000" }, { "udp_stream": 0, "frame_number": 370, "display_filter": "frame.number == 370", "timestamp_epoch": "1566329451.367358000" }, { "udp_stream": 0, "frame_number": 376, "display_filter": "frame.number == 376", "timestamp_epoch": "1566329452.116487000" } ], "raw_values": [ "BADBUNDT<00>,BADBUNDT<00> (Workstation/Redirector)" ], "identity_id": "identity-a5d04f7b83f6dc789398d6bc", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.b.barracudacentral.org", "evidence": [ { "udp_stream": 50, "frame_number": 3072, "display_filter": "frame.number == 3072", "timestamp_epoch": "1566330147.444500000" }, { "udp_stream": 50, "frame_number": 3073, "display_filter": "frame.number == 3073", "timestamp_epoch": "1566330147.516641000" } ], "is_private": null, "observable_id": "observable-7b118f35525990a90dc785ca", "last_seen_epoch": "1566330147.516641000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330147.444500000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.cbl.abuseat.org", "evidence": [ { "udp_stream": 49, "frame_number": 3069, "display_filter": "frame.number == 3069", "timestamp_epoch": "1566330147.376289000" }, { "udp_stream": 49, "frame_number": 3071, "display_filter": "frame.number == 3071", "timestamp_epoch": "1566330147.443688000" } ], "is_private": null, "observable_id": "observable-04c5ce19f7b8e111cc8386a8", "last_seen_epoch": "1566330147.443688000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330147.376289000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.dnsbl-1.uceprotect.net", "evidence": [ { "udp_stream": 51, "frame_number": 3074, "display_filter": "frame.number == 3074", "timestamp_epoch": "1566330147.518389000" }, { "udp_stream": 51, "frame_number": 3075, "display_filter": "frame.number == 3075", "timestamp_epoch": "1566330147.580034000" } ], "is_private": null, "observable_id": "observable-75033825e0b5c6ed327f0acc", "last_seen_epoch": "1566330147.580034000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330147.518389000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.spam.dnsbl.sorbs.net", "evidence": [ { "udp_stream": 52, "frame_number": 3076, "display_filter": "frame.number == 3076", "timestamp_epoch": "1566330147.581274000" }, { "udp_stream": 52, "frame_number": 3077, "display_filter": "frame.number == 3077", "timestamp_epoch": "1566330147.609808000" } ], "is_private": null, "observable_id": "observable-7d98cecfde589f5b088e9d9c", "last_seen_epoch": "1566330147.609808000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330147.581274000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "112.146.166.173.zen.spamhaus.org", "evidence": [ { "udp_stream": 48, "frame_number": 3067, "display_filter": "frame.number == 3067", "timestamp_epoch": "1566330147.304370000" }, { "udp_stream": 48, "frame_number": 3068, "display_filter": "frame.number == 3068", "timestamp_epoch": "1566330147.374893000" } ], "is_private": null, "observable_id": "observable-d545cfd6cf9d85335bfbcefe", "last_seen_epoch": "1566330147.374893000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330147.304370000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "222.222.67.208.in-addr.arpa", "evidence": [ { "udp_stream": 41, "frame_number": 1965, "display_filter": "frame.number == 1965", "timestamp_epoch": "1566329796.096059000" }, { "udp_stream": 41, "frame_number": 1966, "display_filter": "frame.number == 1966", "timestamp_epoch": "1566329796.110202000" } ], "is_private": null, "observable_id": "observable-ec760542e3fc117a148fb065", "last_seen_epoch": "1566329796.110202000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329796.096059000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "activity.qingcloud.com", "evidence": [ { "udp_stream": 46, "frame_number": 2133, "display_filter": "frame.number == 2133", "timestamp_epoch": "1566330098.980354000" }, { "udp_stream": 46, "frame_number": 2134, "display_filter": "frame.number == 2134", "timestamp_epoch": "1566330099.301598000" }, { "tcp_stream": 64, "frame_number": 2138, "display_filter": "frame.number == 2138", "timestamp_epoch": "1566330099.486377000" }, { "tcp_stream": 65, "frame_number": 2147, "display_filter": "frame.number == 2147", "timestamp_epoch": "1566330099.858365000" } ], "is_private": null, "observable_id": "observable-dc71d5790d2c28104961b508", "last_seen_epoch": "1566330099.858365000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330098.980354000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "api.ip.sb", "evidence": [ { "udp_stream": 47, "frame_number": 3000, "display_filter": "frame.number == 3000", "timestamp_epoch": "1566330133.296128000" }, { "udp_stream": 47, "frame_number": 3001, "display_filter": "frame.number == 3001", "timestamp_epoch": "1566330133.355663000" }, { "tcp_stream": 67, "frame_number": 3006, "display_filter": "frame.number == 3006", "timestamp_epoch": "1566330133.404271000" } ], "is_private": null, "observable_id": "observable-664eb442fe2727bedc1ba074", "last_seen_epoch": "1566330133.404271000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330133.296128000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "badbundt-dc.badbundt.com", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1566329449.880862000" }, { "udp_stream": 4, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1566329449.881049000" }, { "udp_stream": 3, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1566329449.881124000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1566329449.881216000" }, { "udp_stream": 19, "frame_number": 389, "display_filter": "frame.number == 389", "timestamp_epoch": "1566329453.214843000" }, { "udp_stream": 19, "frame_number": 390, "display_filter": "frame.number == 390", "timestamp_epoch": "1566329453.215159000" }, { "udp_stream": 23, "frame_number": 403, "display_filter": "frame.number == 403", "timestamp_epoch": "1566329454.713695000" }, { "udp_stream": 23, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1566329454.714016000" }, { "udp_stream": 64, "frame_number": 10005, "display_filter": "frame.number == 10005", "timestamp_epoch": "1566330654.941768000" }, { "udp_stream": 64, "frame_number": 10006, "display_filter": "frame.number == 10006", "timestamp_epoch": "1566330654.942042000" }, { "udp_stream": 65, "frame_number": 10026, "display_filter": "frame.number == 10026", "timestamp_epoch": "1566330654.977069000" }, { "udp_stream": 65, "frame_number": 10027, "display_filter": "frame.number == 10027", "timestamp_epoch": "1566330654.977320000" } ], "is_private": null, "observable_id": "observable-6528a0d7e0f23e9d004d116f", "last_seen_epoch": "1566330654.977320000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329449.880862000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "badbundt.com", "evidence": [ { "udp_stream": 27, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1566329458.112209000" }, { "udp_stream": 27, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1566329458.112974000" } ], "is_private": null, "observable_id": "observable-7500902792da74312c051183", "last_seen_epoch": "1566329458.112974000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329458.112209000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "bh79sbu.com", "evidence": [ { "udp_stream": 31, "frame_number": 682, "display_filter": "frame.number == 682", "timestamp_epoch": "1566329493.324340000" }, { "udp_stream": 31, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1566329493.560314000" }, { "tcp_stream": 44, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1566329493.792567000" } ], "is_private": null, "observable_id": "observable-2872c2314796c8bd53b2d387", "last_seen_epoch": "1566329493.792567000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329493.324340000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "boozzdigital.com", "evidence": [ { "udp_stream": 66, "frame_number": 12664, "display_filter": "frame.number == 12664", "timestamp_epoch": "1566330702.438541000" }, { "udp_stream": 66, "frame_number": 12665, "display_filter": "frame.number == 12665", "timestamp_epoch": "1566330702.513714000" }, { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" } ], "is_private": null, "observable_id": "observable-30d4c230e12e9ee911a6c981", "last_seen_epoch": "1566330702.734890000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330702.438541000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 30, "frame_number": 650, "display_filter": "frame.number == 650", "timestamp_epoch": "1566329465.460030000" }, { "udp_stream": 30, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1566329465.486337000" } ], "is_private": null, "observable_id": "observable-3d0ecf3e285094d5d2fd3f9b", "last_seen_epoch": "1566329465.486337000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329465.460030000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "gmail.com", "evidence": [ { "udp_stream": 38, "frame_number": 1367, "display_filter": "frame.number == 1367", "timestamp_epoch": "1566329702.684441000" }, { "udp_stream": 38, "frame_number": 1368, "display_filter": "frame.number == 1368", "timestamp_epoch": "1566329702.707409000" }, { "tcp_stream": 53, "frame_number": 1375, "display_filter": "frame.number == 1375", "timestamp_epoch": "1566329702.734179000" }, { "tcp_stream": 54, "frame_number": 1376, "display_filter": "frame.number == 1376", "timestamp_epoch": "1566329702.734255000" }, { "tcp_stream": 60, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1566329796.596839000" } ], "is_private": null, "observable_id": "observable-65b4739f84faa9874ec8b661", "last_seen_epoch": "1566329796.596839000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329702.684441000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "google.com", "evidence": [ { "udp_stream": 36, "frame_number": 1322, "display_filter": "frame.number == 1322", "timestamp_epoch": "1566329681.389915000" }, { "udp_stream": 36, "frame_number": 1324, "display_filter": "frame.number == 1324", "timestamp_epoch": "1566329681.506167000" }, { "tcp_stream": 50, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1566329681.527712000" }, { "tcp_stream": 59, "frame_number": 1975, "display_filter": "frame.number == 1975", "timestamp_epoch": "1566329796.463128000" } ], "is_private": null, "observable_id": "observable-a27317ab40df8f093af1ba77", "last_seen_epoch": "1566329796.463128000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.389915000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "hne53brianaea.com", "evidence": [ { "udp_stream": 39, "frame_number": 1444, "display_filter": "frame.number == 1444", "timestamp_epoch": "1566329723.938616000" }, { "udp_stream": 39, "frame_number": 1445, "display_filter": "frame.number == 1445", "timestamp_epoch": "1566329723.982026000" }, { "tcp_stream": 58, "frame_number": 1452, "display_filter": "frame.number == 1452", "timestamp_epoch": "1566329724.149645000" }, { "tcp_stream": 58, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1566329725.102711000" }, { "tcp_stream": 58, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1566329726.204629000" }, { "tcp_stream": 58, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1566329727.940226000" } ], "is_private": null, "observable_id": "observable-f38b53e471f7f448f1c1b332", "last_seen_epoch": "1566329727.940226000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329723.938616000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "idogoiania.com.br", "evidence": [ { "udp_stream": 53, "frame_number": 3246, "display_filter": "frame.number == 3246", "timestamp_epoch": "1566330403.320857000" }, { "udp_stream": 53, "frame_number": 3247, "display_filter": "frame.number == 3247", "timestamp_epoch": "1566330403.344480000" }, { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" }, { "tcp_stream": 73, "frame_number": 3258, "display_filter": "frame.number == 3258", "timestamp_epoch": "1566330403.494827000" } ], "is_private": null, "observable_id": "observable-24b96fd058243260fb469515", "last_seen_epoch": "1566330403.494827000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330403.320857000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.badbundt.com", "evidence": [ { "udp_stream": 20, "frame_number": 391, "display_filter": "frame.number == 391", "timestamp_epoch": "1566329453.229001000" }, { "udp_stream": 20, "frame_number": 392, "display_filter": "frame.number == 392", "timestamp_epoch": "1566329453.229263000" } ], "is_private": null, "observable_id": "observable-6033714c03577c9ccb9aa259", "last_seen_epoch": "1566329453.229263000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329453.229001000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "isatap.localdomain", "evidence": [ { "udp_stream": 21, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1566329453.374157000" }, { "udp_stream": 21, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1566329453.374403000" } ], "is_private": null, "observable_id": "observable-9f27c9c97627dfe83d1d81ce", "last_seen_epoch": "1566329453.374403000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329453.374157000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "kjoanaxbrennan.top", "evidence": [ { "udp_stream": 44, "frame_number": 2011, "display_filter": "frame.number == 2011", "timestamp_epoch": "1566329806.704700000" }, { "udp_stream": 44, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1566329806.728922000" }, { "tcp_stream": 61, "frame_number": 2016, "display_filter": "frame.number == 2016", "timestamp_epoch": "1566329807.014331000" }, { "tcp_stream": 63, "frame_number": 2121, "display_filter": "frame.number == 2121", "timestamp_epoch": "1566330096.772646000" }, { "tcp_stream": 70, "frame_number": 3219, "display_filter": "frame.number == 3219", "timestamp_epoch": "1566330396.793237000" }, { "tcp_stream": 71, "frame_number": 3234, "display_filter": "frame.number == 3234", "timestamp_epoch": "1566330400.345365000" }, { "tcp_stream": 74, "frame_number": 4029, "display_filter": "frame.number == 4029", "timestamp_epoch": "1566330414.450514000" }, { "tcp_stream": 77, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1566330556.689758000" }, { "tcp_stream": 79, "frame_number": 4766, "display_filter": "frame.number == 4766", "timestamp_epoch": "1566330561.386285000" }, { "tcp_stream": 80, "frame_number": 4796, "display_filter": "frame.number == 4796", "timestamp_epoch": "1566330562.910490000" }, { "tcp_stream": 81, "frame_number": 5981, "display_filter": "frame.number == 5981", "timestamp_epoch": "1566330564.474323000" }, { "tcp_stream": 128, "frame_number": 12444, "display_filter": "frame.number == 12444", "timestamp_epoch": "1566330700.286861000" }, { "tcp_stream": 133, "frame_number": 13810, "display_filter": "frame.number == 13810", "timestamp_epoch": "1566330716.398453000" }, { "tcp_stream": 144, "frame_number": 17529, "display_filter": "frame.number == 17529", "timestamp_epoch": "1566331000.259793000" }, { "tcp_stream": 145, "frame_number": 17544, "display_filter": "frame.number == 17544", "timestamp_epoch": "1566331002.177022000" }, { "tcp_stream": 146, "frame_number": 17563, "display_filter": "frame.number == 17563", "timestamp_epoch": "1566331014.466484000" }, { "tcp_stream": 147, "frame_number": 17582, "display_filter": "frame.number == 17582", "timestamp_epoch": "1566331016.615305000" }, { "tcp_stream": 154, "frame_number": 18331, "display_filter": "frame.number == 18331", "timestamp_epoch": "1566331302.117270000" }, { "tcp_stream": 155, "frame_number": 18346, "display_filter": "frame.number == 18346", "timestamp_epoch": "1566331314.058492000" }, { "tcp_stream": 157, "frame_number": 18398, "display_filter": "frame.number == 18398", "timestamp_epoch": "1566331602.113804000" } ], "is_private": null, "observable_id": "observable-6145d3a3fe4924ac0acbff5d", "last_seen_epoch": "1566331605.542730000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329806.704700000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mail.protonmail.com", "evidence": [ { "udp_stream": 67, "frame_number": 18571, "display_filter": "frame.number == 18571", "timestamp_epoch": "1566331706.334139000" }, { "udp_stream": 67, "frame_number": 18572, "display_filter": "frame.number == 18572", "timestamp_epoch": "1566331706.356424000" }, { "udp_stream": 68, "frame_number": 18605, "display_filter": "frame.number == 18605", "timestamp_epoch": "1566331707.347278000" }, { "udp_stream": 68, "frame_number": 18606, "display_filter": "frame.number == 18606", "timestamp_epoch": "1566331707.347774000" }, { "tcp_stream": 165, "frame_number": 18580, "display_filter": "frame.number == 18580", "timestamp_epoch": "1566331706.796137000" }, { "tcp_stream": 166, "frame_number": 18581, "display_filter": "frame.number == 18581", "timestamp_epoch": "1566331706.796557000" }, { "tcp_stream": 164, "frame_number": 18620, "display_filter": "frame.number == 18620", "timestamp_epoch": "1566331707.731554000" }, { "tcp_stream": 167, "frame_number": 18621, "display_filter": "frame.number == 18621", "timestamp_epoch": "1566331707.731808000" }, { "tcp_stream": 168, "frame_number": 18708, "display_filter": "frame.number == 18708", "timestamp_epoch": "1566331712.707683000" }, { "tcp_stream": 170, "frame_number": 18710, "display_filter": "frame.number == 18710", "timestamp_epoch": "1566331712.707971000" }, { "tcp_stream": 169, "frame_number": 18731, "display_filter": "frame.number == 18731", "timestamp_epoch": "1566331712.983119000" }, { "tcp_stream": 171, "frame_number": 18732, "display_filter": "frame.number == 18732", "timestamp_epoch": "1566331712.983373000" }, { "tcp_stream": 172, "frame_number": 18833, "display_filter": "frame.number == 18833", "timestamp_epoch": "1566331715.122500000" }, { "tcp_stream": 174, "frame_number": 18834, "display_filter": "frame.number == 18834", "timestamp_epoch": "1566331715.122670000" }, { "tcp_stream": 173, "frame_number": 18851, "display_filter": "frame.number == 18851", "timestamp_epoch": "1566331715.355376000" }, { "tcp_stream": 175, "frame_number": 18852, "display_filter": "frame.number == 18852", "timestamp_epoch": "1566331715.355555000" }, { "tcp_stream": 176, "frame_number": 18911, "display_filter": "frame.number == 18911", "timestamp_epoch": "1566331716.329521000" }, { "tcp_stream": 177, "frame_number": 18912, "display_filter": "frame.number == 18912", "timestamp_epoch": "1566331716.329711000" } ], "is_private": null, "observable_id": "observable-0d1f5c055d4ec2c664cc8af5", "last_seen_epoch": "1566331716.329711000", "enrichment_state": "not_requested", "first_seen_epoch": "1566331706.334139000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com", "evidence": [ { "udp_stream": 43, "frame_number": 1969, "display_filter": "frame.number == 1969", "timestamp_epoch": "1566329796.285649000" }, { "udp_stream": 43, "frame_number": 1970, "display_filter": "frame.number == 1970", "timestamp_epoch": "1566329796.306864000" } ], "is_private": null, "observable_id": "observable-cb2cfd5a30899afdd0e2fa31", "last_seen_epoch": "1566329796.306864000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329796.285649000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "myip.opendns.com.badbundt.com", "evidence": [ { "udp_stream": 42, "frame_number": 1967, "display_filter": "frame.number == 1967", "timestamp_epoch": "1566329796.110953000" }, { "udp_stream": 42, "frame_number": 1968, "display_filter": "frame.number == 1968", "timestamp_epoch": "1566329796.162199000" } ], "is_private": null, "observable_id": "observable-a06eb7adbdfa2f124719b814", "last_seen_epoch": "1566329796.162199000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329796.110953000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "resolver1.opendns.com", "evidence": [ { "udp_stream": 40, "frame_number": 1963, "display_filter": "frame.number == 1963", "timestamp_epoch": "1566329796.056738000" }, { "udp_stream": 40, "frame_number": 1964, "display_filter": "frame.number == 1964", "timestamp_epoch": "1566329796.089726000" } ], "is_private": null, "observable_id": "observable-37e922845b036d15b22b06a6", "last_seen_epoch": "1566329796.089726000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329796.056738000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "tampa-office-pc.badbundt.com", "evidence": [ { "udp_stream": 26, "frame_number": 419, "display_filter": "frame.number == 419", "timestamp_epoch": "1566329458.111159000" }, { "udp_stream": 26, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1566329458.111494000" } ], "is_private": null, "observable_id": "observable-32df5a52781cbed85c85369c", "last_seen_epoch": "1566329458.111494000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329458.111159000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.badbundt.com", "evidence": [ { "udp_stream": 17, "frame_number": 382, "display_filter": "frame.number == 382", "timestamp_epoch": "1566329453.107072000" }, { "udp_stream": 17, "frame_number": 383, "display_filter": "frame.number == 383", "timestamp_epoch": "1566329453.107285000" }, { "udp_stream": 33, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1566329681.344278000" }, { "udp_stream": 33, "frame_number": 1318, "display_filter": "frame.number == 1318", "timestamp_epoch": "1566329681.344602000" }, { "udp_stream": 61, "frame_number": 9398, "display_filter": "frame.number == 9398", "timestamp_epoch": "1566330632.760456000" }, { "udp_stream": 61, "frame_number": 9399, "display_filter": "frame.number == 9399", "timestamp_epoch": "1566330632.760705000" } ], "is_private": null, "observable_id": "observable-784acf2b9fdde67c65b66f0f", "last_seen_epoch": "1566330632.760705000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329453.107072000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 34, "frame_number": 1319, "display_filter": "frame.number == 1319", "timestamp_epoch": "1566329681.344864000" }, { "udp_stream": 34, "frame_number": 1320, "display_filter": "frame.number == 1320", "timestamp_epoch": "1566329681.345121000" }, { "udp_stream": 62, "frame_number": 9400, "display_filter": "frame.number == 9400", "timestamp_epoch": "1566330632.761022000" }, { "udp_stream": 62, "frame_number": 9401, "display_filter": "frame.number == 9401", "timestamp_epoch": "1566330632.778985000" } ], "is_private": null, "observable_id": "observable-93ab03860be98084d1d5af8d", "last_seen_epoch": "1566330632.778985000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.344864000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.download.windowsupdate.com", "evidence": [ { "udp_stream": 45, "frame_number": 2024, "display_filter": "frame.number == 2024", "timestamp_epoch": "1566329807.511295000" }, { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" }, { "tcp_stream": 62, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1566329807.592332000" } ], "is_private": null, "observable_id": "observable-783b1f363740606bcbbff02e", "last_seen_epoch": "1566329807.592332000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.511295000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.google.com", "evidence": [ { "udp_stream": 37, "frame_number": 1336, "display_filter": "frame.number == 1336", "timestamp_epoch": "1566329681.632531000" }, { "udp_stream": 37, "frame_number": 1338, "display_filter": "frame.number == 1338", "timestamp_epoch": "1566329681.649446000" }, { "tcp_stream": 51, "frame_number": 1345, "display_filter": "frame.number == 1345", "timestamp_epoch": "1566329681.671214000" }, { "tcp_stream": 52, "frame_number": 1347, "display_filter": "frame.number == 1347", "timestamp_epoch": "1566329681.671312000" }, { "tcp_stream": 55, "frame_number": 1405, "display_filter": "frame.number == 1405", "timestamp_epoch": "1566329702.918816000" }, { "tcp_stream": 56, "frame_number": 1406, "display_filter": "frame.number == 1406", "timestamp_epoch": "1566329702.918961000" } ], "is_private": null, "observable_id": "observable-d936b96dfb5314a188d494ec", "last_seen_epoch": "1566329702.918961000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.632531000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.msftncsi.com", "evidence": [ { "udp_stream": 25, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1566329455.680831000" }, { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" }, { "tcp_stream": 27, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1566329455.750243000" } ], "is_private": null, "observable_id": "observable-048b4cb86793c2aedf30ecbf", "last_seen_epoch": "1566329455.750243000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.680831000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.8.20.1", "evidence": [], "is_private": true, "observable_id": "observable-7914b9687e0a2660e2bff9e8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.8.20.101", "evidence": [ { "udp_stream": 27, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1566329458.112209000" }, { "udp_stream": 27, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1566329458.112974000" } ], "is_private": true, "observable_id": "observable-645e5094052ac25736dc7f8b", "last_seen_epoch": "1566329458.112974000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329458.112209000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.8.20.255", "evidence": [], "is_private": true, "observable_id": "observable-2694a54aaa506930e5cce67f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.8.20.8", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1566329449.877379000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1566329449.878593000" }, { "udp_stream": 3, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1566329449.881124000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1566329449.881216000" }, { "udp_stream": 8, "frame_number": 63, "display_filter": "frame.number == 63", "timestamp_epoch": "1566329450.068849000" }, { "udp_stream": 10, "frame_number": 101, "display_filter": "frame.number == 101", "timestamp_epoch": "1566329450.079103000" }, { "udp_stream": 12, "frame_number": 181, "display_filter": "frame.number == 181", "timestamp_epoch": "1566329450.184657000" }, { "udp_stream": 19, "frame_number": 390, "display_filter": "frame.number == 390", "timestamp_epoch": "1566329453.215159000" }, { "udp_stream": 23, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1566329454.714016000" }, { "udp_stream": 26, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1566329458.111494000" }, { "udp_stream": 57, "frame_number": 8997, "display_filter": "frame.number == 8997", "timestamp_epoch": "1566330632.497685000" }, { "udp_stream": 64, "frame_number": 10006, "display_filter": "frame.number == 10006", "timestamp_epoch": "1566330654.942042000" }, { "udp_stream": 65, "frame_number": 10027, "display_filter": "frame.number == 10027", "timestamp_epoch": "1566330654.977320000" } ], "is_private": true, "observable_id": "observable-c93be9b8d1bf6dc797a15403", "last_seen_epoch": "1566330654.977320000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329449.877379000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 30, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1566329465.486337000" } ], "is_private": false, "observable_id": "observable-9a553af7f062327d334a966a", "last_seen_epoch": "1566329465.486337000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329465.486337000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "139.198.5.65", "evidence": [ { "udp_stream": 46, "frame_number": 2134, "display_filter": "frame.number == 2134", "timestamp_epoch": "1566330099.301598000" } ], "is_private": false, "observable_id": "observable-5d984e24ad0e151167b5c1e9", "last_seen_epoch": "1566330099.301598000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330099.301598000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "170.238.117.187", "evidence": [ { "tcp_stream": 85, "frame_number": 6923, "display_filter": "frame.number == 6923", "timestamp_epoch": "1566330616.714903000" }, { "tcp_stream": 86, "frame_number": 7165, "display_filter": "frame.number == 7165", "timestamp_epoch": "1566330619.221754000" }, { "tcp_stream": 87, "frame_number": 7772, "display_filter": "frame.number == 7772", "timestamp_epoch": "1566330622.260866000" }, { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" }, { "tcp_stream": 152, "frame_number": 18243, "display_filter": "frame.number == 18243", "timestamp_epoch": "1566331165.717613000" } ], "is_private": false, "observable_id": "observable-e25e628327ad51e2aa4a33ae", "last_seen_epoch": "1566331165.717613000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330616.714903000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.133", "evidence": [ { "udp_stream": 38, "frame_number": 1368, "display_filter": "frame.number == 1368", "timestamp_epoch": "1566329702.707409000" } ], "is_private": false, "observable_id": "observable-981a714d36e3fdd9264f0979", "last_seen_epoch": "1566329702.707409000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329702.707409000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.6.174", "evidence": [ { "udp_stream": 36, "frame_number": 1324, "display_filter": "frame.number == 1324", "timestamp_epoch": "1566329681.506167000" } ], "is_private": false, "observable_id": "observable-c0215af8fbf8ae796aeed1eb", "last_seen_epoch": "1566329681.506167000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.506167000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.9.132", "evidence": [ { "udp_stream": 37, "frame_number": 1338, "display_filter": "frame.number == 1338", "timestamp_epoch": "1566329681.649446000" } ], "is_private": false, "observable_id": "observable-034b80ab0dccddb8dd05c324", "last_seen_epoch": "1566329681.649446000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.649446000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "173.166.146.112", "evidence": [ { "udp_stream": 43, "frame_number": 1970, "display_filter": "frame.number == 1970", "timestamp_epoch": "1566329796.306864000" } ], "is_private": false, "observable_id": "observable-a77dcd1351c1c18b72c1fa8c", "last_seen_epoch": "1566329796.306864000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329796.306864000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "185.117.75.41", "evidence": [], "is_private": false, "observable_id": "observable-5f89639e9c64bd56156581bd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "185.183.98.232", "evidence": [ { "tcp_stream": 82, "frame_number": 6112, "display_filter": "frame.number == 6112", "timestamp_epoch": "1566330597.277074000" }, { "tcp_stream": 88, "frame_number": 7765, "display_filter": "frame.number == 7765", "timestamp_epoch": "1566330622.134171000" }, { "tcp_stream": 123, "frame_number": 10374, "display_filter": "frame.number == 10374", "timestamp_epoch": "1566330655.213787000" }, { "tcp_stream": 141, "frame_number": 16701, "display_filter": "frame.number == 16701", "timestamp_epoch": "1566330829.918742000" } ], "is_private": false, "observable_id": "observable-f0bbbac95635e8c7be0e6fb5", "last_seen_epoch": "1566330829.918742000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330597.277074000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.193.141.166", "evidence": [ { "udp_stream": 44, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1566329806.728922000" } ], "is_private": false, "observable_id": "observable-07f01c94d13013435c8a9070", "last_seen_epoch": "1566329806.728922000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329806.728922000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.248.87.88", "evidence": [ { "udp_stream": 47, "frame_number": 3001, "display_filter": "frame.number == 3001", "timestamp_epoch": "1566330133.355663000" } ], "is_private": false, "observable_id": "observable-a9dc749174d403b84ad5014e", "last_seen_epoch": "1566330133.355663000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330133.355663000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "185.70.40.151", "evidence": [ { "udp_stream": 67, "frame_number": 18572, "display_filter": "frame.number == 18572", "timestamp_epoch": "1566331706.356424000" }, { "udp_stream": 68, "frame_number": 18606, "display_filter": "frame.number == 18606", "timestamp_epoch": "1566331707.347774000" } ], "is_private": false, "observable_id": "observable-7adb3bbfc0a683bf830d1b38", "last_seen_epoch": "1566331707.347774000", "enrichment_state": "not_requested", "first_seen_epoch": "1566331706.356424000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "191.37.181.152", "evidence": [], "is_private": false, "observable_id": "observable-048cdd6f0b38901637449708", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "192.185.170.206", "evidence": [], "is_private": false, "observable_id": "observable-1f1600b025b974237d45a23a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "192.252.210.19", "evidence": [], "is_private": false, "observable_id": "observable-ea07a8d8189caf7c90845915", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "206.189.74.47", "evidence": [ { "udp_stream": 53, "frame_number": 3247, "display_filter": "frame.number == 3247", "timestamp_epoch": "1566330403.344480000" } ], "is_private": false, "observable_id": "observable-293052200eda7e4390f50794", "last_seen_epoch": "1566330403.344480000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330403.344480000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "208.67.222.222", "evidence": [ { "udp_stream": 40, "frame_number": 1964, "display_filter": "frame.number == 1964", "timestamp_epoch": "1566329796.089726000" } ], "is_private": false, "observable_id": "observable-f8fb4211fb318cbae2df8505", "last_seen_epoch": "1566329796.089726000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329796.089726000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-0881320bb00eca1180c20053", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-a0ede5a807a52bdf7796e0b1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.27", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-ef5911fdfba56033010eec03", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.35", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-881c798ca264c4202a3347d4", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.41", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-0606c275bff832fd5b0bb6aa", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.43", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-235a358db2ca6096d1308573", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.50", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-1904be72ac7b74cb665a1b87", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.56", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-c41f2e4ab5ae54ae2d8ff669", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.57", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-0c7e5c818531bb14a16e7137", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.200.143.72", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-d81c14f34c0a837fca3e70c5", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.200.143.74", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "is_private": false, "observable_id": "observable-11544a7563a858e5742b5901", "last_seen_epoch": "1566329807.574008000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.574008000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 1287, "display_filter": "frame.number == 1287", "timestamp_epoch": "1566329570.525266000" }, { "frame_number": 1297, "display_filter": "frame.number == 1297", "timestamp_epoch": "1566329570.863599000" }, { "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1566329573.535572000" }, { "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1566329573.862553000" }, { "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1566329576.545804000" }, { "frame_number": 1302, "display_filter": "frame.number == 1302", "timestamp_epoch": "1566329576.873927000" } ], "is_private": false, "observable_id": "observable-b3161a4f30fee8ddb55ec2f7", "last_seen_epoch": "1566329576.873927000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329570.525266000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "5.39.113.142", "evidence": [], "is_private": false, "observable_id": "observable-e15727ee89ede04ed5437319", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.68", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-978a572fbfd4f85a3115bd16", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.75", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-e59b45ff49b62cfc7eb74ce4", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.76", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-28065a24652efc8444512d3f", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.82", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-4af8d04affb3c8a0d744f153", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.83", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-99ecda851e539d3e16d1e764", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.84", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-f268976e63e453aae5ba9b79", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "63.239.233.90", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-c66c4ebcd441dcaf2aea57d4", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.91", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-01f2691f83187c060580aa14", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "63.239.233.92", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "is_private": false, "observable_id": "observable-02092a219a160b493c6e94ef", "last_seen_epoch": "1566329455.710994000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.710994000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "68.183.185.221", "evidence": [ { "udp_stream": 66, "frame_number": 12665, "display_filter": "frame.number == 12665", "timestamp_epoch": "1566330702.513714000" } ], "is_private": false, "observable_id": "observable-383ce369310daf86ee18e3a5", "last_seen_epoch": "1566330702.513714000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330702.513714000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "89.105.203.184", "evidence": [], "is_private": false, "observable_id": "observable-76112c7ac88b5df439bc95c0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "94.103.86.146", "evidence": [ { "udp_stream": 39, "frame_number": 1445, "display_filter": "frame.number == 1445", "timestamp_epoch": "1566329723.982026000" } ], "is_private": false, "observable_id": "observable-228211530e98896a451e3445", "last_seen_epoch": "1566329723.982026000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329723.982026000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "94.103.87.160", "evidence": [ { "udp_stream": 31, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1566329493.560314000" } ], "is_private": false, "observable_id": "observable-f94c7be5f2c58b077e2c0132", "last_seen_epoch": "1566329493.560314000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329493.560314000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "1d095e68489d3c535297cd8dffb06cb9", "evidence": [ { "tcp_stream": 67, "frame_number": 3006, "display_filter": "frame.number == 3006", "timestamp_epoch": "1566330133.404271000" } ], "is_private": null, "observable_id": "observable-501509b94fcc7fedab9ae937", "last_seen_epoch": "1566330133.404271000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330133.404271000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "398430069e0a8ecfbc8db0778d658d77", "evidence": [ { "tcp_stream": 165, "frame_number": 18580, "display_filter": "frame.number == 18580", "timestamp_epoch": "1566331706.796137000" }, { "tcp_stream": 166, "frame_number": 18581, "display_filter": "frame.number == 18581", "timestamp_epoch": "1566331706.796557000" }, { "tcp_stream": 164, "frame_number": 18620, "display_filter": "frame.number == 18620", "timestamp_epoch": "1566331707.731554000" }, { "tcp_stream": 167, "frame_number": 18621, "display_filter": "frame.number == 18621", "timestamp_epoch": "1566331707.731808000" }, { "tcp_stream": 168, "frame_number": 18708, "display_filter": "frame.number == 18708", "timestamp_epoch": "1566331712.707683000" }, { "tcp_stream": 170, "frame_number": 18710, "display_filter": "frame.number == 18710", "timestamp_epoch": "1566331712.707971000" }, { "tcp_stream": 169, "frame_number": 18731, "display_filter": "frame.number == 18731", "timestamp_epoch": "1566331712.983119000" }, { "tcp_stream": 171, "frame_number": 18732, "display_filter": "frame.number == 18732", "timestamp_epoch": "1566331712.983373000" }, { "tcp_stream": 172, "frame_number": 18833, "display_filter": "frame.number == 18833", "timestamp_epoch": "1566331715.122500000" }, { "tcp_stream": 174, "frame_number": 18834, "display_filter": "frame.number == 18834", "timestamp_epoch": "1566331715.122670000" }, { "tcp_stream": 173, "frame_number": 18851, "display_filter": "frame.number == 18851", "timestamp_epoch": "1566331715.355376000" }, { "tcp_stream": 175, "frame_number": 18852, "display_filter": "frame.number == 18852", "timestamp_epoch": "1566331715.355555000" }, { "tcp_stream": 176, "frame_number": 18911, "display_filter": "frame.number == 18911", "timestamp_epoch": "1566331716.329521000" }, { "tcp_stream": 177, "frame_number": 18912, "display_filter": "frame.number == 18912", "timestamp_epoch": "1566331716.329711000" } ], "is_private": null, "observable_id": "observable-e9fbd9df4e097dbfc618d9f4", "last_seen_epoch": "1566331716.329711000", "enrichment_state": "not_requested", "first_seen_epoch": "1566331706.796137000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "4d7a28d6f2263ed61de88ca66eb011e3", "evidence": [ { "tcp_stream": 53, "frame_number": 1375, "display_filter": "frame.number == 1375", "timestamp_epoch": "1566329702.734179000" }, { "tcp_stream": 54, "frame_number": 1376, "display_filter": "frame.number == 1376", "timestamp_epoch": "1566329702.734255000" }, { "tcp_stream": 55, "frame_number": 1405, "display_filter": "frame.number == 1405", "timestamp_epoch": "1566329702.918816000" }, { "tcp_stream": 56, "frame_number": 1406, "display_filter": "frame.number == 1406", "timestamp_epoch": "1566329702.918961000" }, { "tcp_stream": 59, "frame_number": 1975, "display_filter": "frame.number == 1975", "timestamp_epoch": "1566329796.463128000" }, { "tcp_stream": 60, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1566329796.596839000" }, { "tcp_stream": 61, "frame_number": 2016, "display_filter": "frame.number == 2016", "timestamp_epoch": "1566329807.014331000" }, { "tcp_stream": 63, "frame_number": 2121, "display_filter": "frame.number == 2121", "timestamp_epoch": "1566330096.772646000" }, { "tcp_stream": 65, "frame_number": 2147, "display_filter": "frame.number == 2147", "timestamp_epoch": "1566330099.858365000" }, { "tcp_stream": 70, "frame_number": 3219, "display_filter": "frame.number == 3219", "timestamp_epoch": "1566330396.793237000" }, { "tcp_stream": 71, "frame_number": 3234, "display_filter": "frame.number == 3234", "timestamp_epoch": "1566330400.345365000" }, { "tcp_stream": 73, "frame_number": 3258, "display_filter": "frame.number == 3258", "timestamp_epoch": "1566330403.494827000" }, { "tcp_stream": 74, "frame_number": 4029, "display_filter": "frame.number == 4029", "timestamp_epoch": "1566330414.450514000" }, { "tcp_stream": 77, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1566330556.689758000" }, { "tcp_stream": 79, "frame_number": 4766, "display_filter": "frame.number == 4766", "timestamp_epoch": "1566330561.386285000" }, { "tcp_stream": 80, "frame_number": 4796, "display_filter": "frame.number == 4796", "timestamp_epoch": "1566330562.910490000" }, { "tcp_stream": 81, "frame_number": 5981, "display_filter": "frame.number == 5981", "timestamp_epoch": "1566330564.474323000" }, { "tcp_stream": 128, "frame_number": 12444, "display_filter": "frame.number == 12444", "timestamp_epoch": "1566330700.286861000" }, { "tcp_stream": 133, "frame_number": 13810, "display_filter": "frame.number == 13810", "timestamp_epoch": "1566330716.398453000" }, { "tcp_stream": 144, "frame_number": 17529, "display_filter": "frame.number == 17529", "timestamp_epoch": "1566331000.259793000" } ], "is_private": null, "observable_id": "observable-bfa074c73ed2403d708d5373", "last_seen_epoch": "1566331605.542730000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329702.734179000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "6734f37431670b3ab4292b8f60f29984", "evidence": [ { "tcp_stream": 66, "frame_number": 2991, "display_filter": "frame.number == 2991", "timestamp_epoch": "1566330131.740930000" }, { "tcp_stream": 68, "frame_number": 3049, "display_filter": "frame.number == 3049", "timestamp_epoch": "1566330143.388957000" }, { "tcp_stream": 75, "frame_number": 4068, "display_filter": "frame.number == 4068", "timestamp_epoch": "1566330548.999853000" }, { "tcp_stream": 76, "frame_number": 4099, "display_filter": "frame.number == 4099", "timestamp_epoch": "1566330549.759892000" }, { "tcp_stream": 78, "frame_number": 4745, "display_filter": "frame.number == 4745", "timestamp_epoch": "1566330558.866955000" }, { "tcp_stream": 89, "frame_number": 8347, "display_filter": "frame.number == 8347", "timestamp_epoch": "1566330625.094807000" }, { "tcp_stream": 142, "frame_number": 16697, "display_filter": "frame.number == 16697", "timestamp_epoch": "1566330829.907424000" }, { "tcp_stream": 143, "frame_number": 17514, "display_filter": "frame.number == 17514", "timestamp_epoch": "1566330958.709210000" }, { "tcp_stream": 148, "frame_number": 17648, "display_filter": "frame.number == 17648", "timestamp_epoch": "1566331160.070534000" }, { "tcp_stream": 149, "frame_number": 17661, "display_filter": "frame.number == 17661", "timestamp_epoch": "1566331161.687989000" }, { "tcp_stream": 156, "frame_number": 18374, "display_filter": "frame.number == 18374", "timestamp_epoch": "1566331471.453731000" }, { "tcp_stream": 159, "frame_number": 18432, "display_filter": "frame.number == 18432", "timestamp_epoch": "1566331673.034437000" }, { "tcp_stream": 160, "frame_number": 18445, "display_filter": "frame.number == 18445", "timestamp_epoch": "1566331674.374722000" }, { "tcp_stream": 161, "frame_number": 18480, "display_filter": "frame.number == 18480", "timestamp_epoch": "1566331675.906866000" } ], "is_private": null, "observable_id": "observable-3b83679b533c8c82e52b0ff6", "last_seen_epoch": "1566331675.906866000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330131.740930000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30", "evidence": [], "is_private": null, "observable_id": "observable-c7f7b640aaeda2494cc3e7a0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844", "evidence": [], "is_private": null, "observable_id": "observable-8d8e25244e2ca72c91de4f93", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15", "evidence": [], "is_private": null, "observable_id": "observable-e5f6869b7469a2aefb192795", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc", "evidence": [], "is_private": null, "observable_id": "observable-8b1b649d4b10286e8a306087", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953", "evidence": [], "is_private": null, "observable_id": "observable-40ac3862c89d23dd7cb8919c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7", "evidence": [], "is_private": null, "observable_id": "observable-0ebed811d2e75888dc9c7525", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "evidence": [], "is_private": null, "observable_id": "observable-c0fb76c930d60b29dcae7c53", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a", "evidence": [], "is_private": null, "observable_id": "observable-4e785586c76111fcd1ba88bd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345", "evidence": [], "is_private": null, "observable_id": "observable-5214352ee03f94c89a793ef2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc", "evidence": [], "is_private": null, "observable_id": "observable-eaa13037c8a79cf0dbdd1e48", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23", "evidence": [], "is_private": null, "observable_id": "observable-f5c4fc5a4c43e245cd3939d4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "evidence": [], "is_private": null, "observable_id": "observable-fbe1b80b9c849b168869db7a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "evidence": [], "is_private": null, "observable_id": "observable-a26b0b7869a3632d32df10a8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139", "evidence": [], "is_private": null, "observable_id": "observable-159e0358482d1e27b62a5ff6", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb", "evidence": [], "is_private": null, "observable_id": "observable-f503b8d1b7fcfcd58e757727", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742", "evidence": [], "is_private": null, "observable_id": "observable-a74e1291762848dbd452a0c0", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224", "evidence": [], "is_private": null, "observable_id": "observable-12b62c6850003db2362a7f92", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1", "evidence": [], "is_private": null, "observable_id": "observable-a9ea059ae6b54d0ed67b6a44", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "evidence": [], "is_private": null, "observable_id": "observable-b242e8f838f2496b976cd57c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437", "evidence": [], "is_private": null, "observable_id": "observable-e6f54acfa8d90eb146d98520", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93", "evidence": [], "is_private": null, "observable_id": "observable-0b15d387477f0d3e1e566f1d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/", "evidence": [ { "tcp_stream": 85, "frame_number": 6923, "display_filter": "frame.number == 6923", "timestamp_epoch": "1566330616.714903000" }, { "tcp_stream": 87, "frame_number": 7772, "display_filter": "frame.number == 7772", "timestamp_epoch": "1566330622.260866000" } ], "is_private": null, "observable_id": "observable-ebe9bf7870e376be70e8a5bb", "last_seen_epoch": "1566330622.260866000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330616.714903000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/", "evidence": [ { "tcp_stream": 86, "frame_number": 7165, "display_filter": "frame.number == 7165", "timestamp_epoch": "1566330619.221754000" } ], "is_private": null, "observable_id": "observable-ab3b0f5a4c87f27be6882fd2", "last_seen_epoch": "1566330619.221754000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330619.221754000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90", "evidence": [ { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" }, { "tcp_stream": 152, "frame_number": 18243, "display_filter": "frame.number == 18243", "timestamp_epoch": "1566331165.717613000" } ], "is_private": null, "observable_id": "observable-75136e90c02077832baed5bd", "last_seen_epoch": "1566331165.717613000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330633.083564000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://185.183.98.232/samerton.png", "evidence": [ { "tcp_stream": 82, "frame_number": 6112, "display_filter": "frame.number == 6112", "timestamp_epoch": "1566330597.277074000" }, { "tcp_stream": 141, "frame_number": 16701, "display_filter": "frame.number == 16701", "timestamp_epoch": "1566330829.918742000" } ], "is_private": null, "observable_id": "observable-2b05789e9a2a774b77f8717f", "last_seen_epoch": "1566330829.918742000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330597.277074000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://185.183.98.232/tablone.png", "evidence": [ { "tcp_stream": 88, "frame_number": 7765, "display_filter": "frame.number == 7765", "timestamp_epoch": "1566330622.134171000" } ], "is_private": null, "observable_id": "observable-742f1fdabf6930de1b805ead", "last_seen_epoch": "1566330622.134171000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330622.134171000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://185.183.98.232/wredneg2.png", "evidence": [ { "tcp_stream": 123, "frame_number": 10374, "display_filter": "frame.number == 10374", "timestamp_epoch": "1566330655.213787000" } ], "is_private": null, "observable_id": "observable-ed9df9285aa0953fa4f363c5", "last_seen_epoch": "1566330655.213787000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330655.213787000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 1287, "display_filter": "frame.number == 1287", "timestamp_epoch": "1566329570.525266000" }, { "frame_number": 1297, "display_filter": "frame.number == 1297", "timestamp_epoch": "1566329570.863599000" }, { "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1566329573.535572000" }, { "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1566329573.862553000" }, { "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1566329576.545804000" }, { "frame_number": 1302, "display_filter": "frame.number == 1302", "timestamp_epoch": "1566329576.873927000" } ], "is_private": null, "observable_id": "observable-546ab98d58759584caf9506f", "last_seen_epoch": "1566329576.873927000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329570.525266000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://activity.qingcloud.com/wp-content/uploads/2019/08/4antifreeze.rar", "evidence": [ { "tcp_stream": 64, "frame_number": 2138, "display_filter": "frame.number == 2138", "timestamp_epoch": "1566330099.486377000" } ], "is_private": null, "observable_id": "observable-b4fe73d4d7fcd3c22cc1b957", "last_seen_epoch": "1566330099.486377000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330099.486377000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://bh79sbu.com/qtra/ttqr.php?l=csuv3.j12", "evidence": [ { "tcp_stream": 44, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1566329493.792567000" } ], "is_private": null, "observable_id": "observable-9f4c5f74781d6f441db81014", "last_seen_epoch": "1566329493.792567000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329493.792567000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://boozzdigital.com/wp-content/uploads/2019/08/antifreeze.rar", "evidence": [ { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" } ], "is_private": null, "observable_id": "observable-b30b39322442412106725bc0", "last_seen_epoch": "1566330702.734890000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330702.734890000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://google.com/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi", "evidence": [ { "tcp_stream": 50, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1566329681.527712000" } ], "is_private": null, "observable_id": "observable-06bfc7eebc287ca176637765", "last_seen_epoch": "1566329681.527712000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.527712000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://hne53brianaea.com/favicon.ico", "evidence": [ { "tcp_stream": 58, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1566329725.102711000" } ], "is_private": null, "observable_id": "observable-2ce9949e7aa600eb01313103", "last_seen_epoch": "1566329725.102711000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329725.102711000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://hne53brianaea.com/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi", "evidence": [ { "tcp_stream": 58, "frame_number": 1452, "display_filter": "frame.number == 1452", "timestamp_epoch": "1566329724.149645000" } ], "is_private": null, "observable_id": "observable-6bd5114c51fbaf19900b2627", "last_seen_epoch": "1566329724.149645000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329724.149645000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://hne53brianaea.com/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi", "evidence": [ { "tcp_stream": 58, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1566329727.940226000" } ], "is_private": null, "observable_id": "observable-b1080ef1b0bcdadd88a8783e", "last_seen_epoch": "1566329727.940226000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329727.940226000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://hne53brianaea.com/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi", "evidence": [ { "tcp_stream": 58, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1566329726.204629000" } ], "is_private": null, "observable_id": "observable-01b0ece8e9914c53ab136c45", "last_seen_epoch": "1566329726.204629000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329726.204629000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://idogoiania.com.br/wp-content/uploads/2019/08/3antifreeze.rar", "evidence": [ { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" } ], "is_private": null, "observable_id": "observable-772bb01dec7f3dcdbf7d9062", "last_seen_epoch": "1566330403.397584000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330403.397584000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "evidence": [ { "tcp_stream": 62, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1566329807.592332000" } ], "is_private": null, "observable_id": "observable-d353112873da665b36ac94b5", "last_seen_epoch": "1566329807.592332000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.592332000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png", "evidence": [ { "tcp_stream": 51, "frame_number": 1345, "display_filter": "frame.number == 1345", "timestamp_epoch": "1566329681.671214000" } ], "is_private": null, "observable_id": "observable-83cd06657fc3cb22082e7071", "last_seen_epoch": "1566329681.671214000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.671214000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google.com/images/errors/robot.png", "evidence": [ { "tcp_stream": 52, "frame_number": 1347, "display_filter": "frame.number == 1347", "timestamp_epoch": "1566329681.671312000" } ], "is_private": null, "observable_id": "observable-f7f2b85013fd63c77c8a5f31", "last_seen_epoch": "1566329681.671312000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.671312000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.msftncsi.com/ncsi.txt", "evidence": [ { "tcp_stream": 27, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1566329455.750243000" } ], "is_private": null, "observable_id": "observable-db27f03e9551a20d1b466a1f", "last_seen_epoch": "1566329455.750243000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.750243000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft NCSI", "evidence": [ { "tcp_stream": 27, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1566329455.750243000" } ], "is_private": null, "observable_id": "observable-539fffc92a834f979ba1fedd", "last_seen_epoch": "1566329455.750243000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329455.750243000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-CryptoAPI/6.1", "evidence": [ { "tcp_stream": 62, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1566329807.592332000" } ], "is_private": null, "observable_id": "observable-87c7b238062abf4d4f6c8763", "last_seen_epoch": "1566329807.592332000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329807.592332000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 85, "frame_number": 6923, "display_filter": "frame.number == 6923", "timestamp_epoch": "1566330616.714903000" }, { "tcp_stream": 86, "frame_number": 7165, "display_filter": "frame.number == 7165", "timestamp_epoch": "1566330619.221754000" }, { "tcp_stream": 87, "frame_number": 7772, "display_filter": "frame.number == 7772", "timestamp_epoch": "1566330622.260866000" } ], "is_private": null, "observable_id": "observable-c679affddee1d08b23eb8cad", "last_seen_epoch": "1566330622.260866000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330616.714903000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64)", "evidence": [ { "tcp_stream": 64, "frame_number": 2138, "display_filter": "frame.number == 2138", "timestamp_epoch": "1566330099.486377000" }, { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" }, { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" } ], "is_private": null, "observable_id": "observable-c7d8273c3aee1d158f45a07d", "last_seen_epoch": "1566330702.734890000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330099.486377000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 50, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1566329681.527712000" }, { "tcp_stream": 51, "frame_number": 1345, "display_filter": "frame.number == 1345", "timestamp_epoch": "1566329681.671214000" }, { "tcp_stream": 52, "frame_number": 1347, "display_filter": "frame.number == 1347", "timestamp_epoch": "1566329681.671312000" }, { "tcp_stream": 58, "frame_number": 1452, "display_filter": "frame.number == 1452", "timestamp_epoch": "1566329724.149645000" }, { "tcp_stream": 58, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1566329725.102711000" }, { "tcp_stream": 58, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1566329726.204629000" }, { "tcp_stream": 58, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1566329727.940226000" } ], "is_private": null, "observable_id": "observable-c4152709c90e57b6e38bfa84", "last_seen_epoch": "1566329727.940226000", "enrichment_state": "not_requested", "first_seen_epoch": "1566329681.527712000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "test", "evidence": [ { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" }, { "tcp_stream": 152, "frame_number": 18243, "display_filter": "frame.number == 18243", "timestamp_epoch": "1566331165.717613000" } ], "is_private": null, "observable_id": "observable-1accca148f844fca30d19b9f", "last_seen_epoch": "1566331165.717613000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330633.083564000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "WinHTTP loader/1.0", "evidence": [ { "tcp_stream": 88, "frame_number": 7765, "display_filter": "frame.number == 7765", "timestamp_epoch": "1566330622.134171000" }, { "tcp_stream": 141, "frame_number": 16701, "display_filter": "frame.number == 16701", "timestamp_epoch": "1566330829.918742000" } ], "is_private": null, "observable_id": "observable-e10cf6f6012e0e9483de524a", "last_seen_epoch": "1566330829.918742000", "enrichment_state": "not_requested", "first_seen_epoch": "1566330622.134171000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "5dd91a89918e17e233f059f813a3ad75e87ad19e9200974e28e6d937749daa60", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" }, { "tcp_stream": 130, "frame_number": 13445, "display_filter": "frame.number == 13445", "timestamp_epoch": "1566330706.025314000" }, { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" }, { "tcp_stream": 72, "frame_number": 3253, "display_filter": "frame.number == 3253", "timestamp_epoch": "1566330403.446640000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-0abca24489f4e58174b4b6c1", "finding-c4ea391d4f3753716864fcd1" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "500da44cbb442f282549a28815bec1dc55e6c0120286c532c43f8dd4a8c5d94d", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 129, "observable_limit": 5000, "observables_total": 129, "matched_observables": 0, "observables_checked": 129, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:04:12.245027+00:00", "session_id": "d882ee83-1604-4cbb-b09b-1739d1fdb5a8", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "134aeb77b8ba938e55dc6221e696fd251149ddd40cfc18c78a3806d709fc25e3", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "5dd91a89918e17e233f059f813a3ad75e87ad19e9200974e28e6d937749daa60", "cross_case_correlations": [ { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 13, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 4, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 5, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "5dd91a89918e17e233f059f813a3ad75e87ad19e9200974e28e6d937749daa60", "items": [ { "observable_id": "observable-7b118f35525990a90dc785ca", "type": "domain", "value": "112.146.166.173.b.barracudacentral.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 50, "frame_number": 3072, "display_filter": "frame.number == 3072", "timestamp_epoch": "1566330147.444500000" }, { "udp_stream": 50, "frame_number": 3073, "display_filter": "frame.number == 3073", "timestamp_epoch": "1566330147.516641000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-04c5ce19f7b8e111cc8386a8", "type": "domain", "value": "112.146.166.173.cbl.abuseat.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 3069, "display_filter": "frame.number == 3069", "timestamp_epoch": "1566330147.376289000" }, { "udp_stream": 49, "frame_number": 3071, "display_filter": "frame.number == 3071", "timestamp_epoch": "1566330147.443688000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75033825e0b5c6ed327f0acc", "type": "domain", "value": "112.146.166.173.dnsbl-1.uceprotect.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 51, "frame_number": 3074, "display_filter": "frame.number == 3074", "timestamp_epoch": "1566330147.518389000" }, { "udp_stream": 51, "frame_number": 3075, "display_filter": "frame.number == 3075", "timestamp_epoch": "1566330147.580034000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d98cecfde589f5b088e9d9c", "type": "domain", "value": "112.146.166.173.spam.dnsbl.sorbs.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 3076, "display_filter": "frame.number == 3076", "timestamp_epoch": "1566330147.581274000" }, { "udp_stream": 52, "frame_number": 3077, "display_filter": "frame.number == 3077", "timestamp_epoch": "1566330147.609808000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d545cfd6cf9d85335bfbcefe", "type": "domain", "value": "112.146.166.173.zen.spamhaus.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 3067, "display_filter": "frame.number == 3067", "timestamp_epoch": "1566330147.304370000" }, { "udp_stream": 48, "frame_number": 3068, "display_filter": "frame.number == 3068", "timestamp_epoch": "1566330147.374893000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec760542e3fc117a148fb065", "type": "domain", "value": "222.222.67.208.in-addr.arpa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 1965, "display_filter": "frame.number == 1965", "timestamp_epoch": "1566329796.096059000" }, { "udp_stream": 41, "frame_number": 1966, "display_filter": "frame.number == 1966", "timestamp_epoch": "1566329796.110202000" } ], "roles": [ "dns-query" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc71d5790d2c28104961b508", "type": "domain", "value": "activity.qingcloud.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.753688+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.575917+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.571352+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 2133, "display_filter": "frame.number == 2133", "timestamp_epoch": "1566330098.980354000" }, { "udp_stream": 46, "frame_number": 2134, "display_filter": "frame.number == 2134", "timestamp_epoch": "1566330099.301598000" }, { "tcp_stream": 64, "frame_number": 2138, "display_filter": "frame.number == 2138", "timestamp_epoch": "1566330099.486377000" }, { "tcp_stream": 65, "frame_number": 2147, "display_filter": "frame.number == 2147", "timestamp_epoch": "1566330099.858365000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:28.565664+00:00" }, { "observable_id": "observable-664eb442fe2727bedc1ba074", "type": "domain", "value": "api.ip.sb", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.842815+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.840062+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 3000, "display_filter": "frame.number == 3000", "timestamp_epoch": "1566330133.296128000" }, { "udp_stream": 47, "frame_number": 3001, "display_filter": "frame.number == 3001", "timestamp_epoch": "1566330133.355663000" }, { "tcp_stream": 67, "frame_number": 3006, "display_filter": "frame.number == 3006", "timestamp_epoch": "1566330133.404271000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:28.837207+00:00" }, { "observable_id": "observable-6528a0d7e0f23e9d004d116f", "type": "domain", "value": "badbundt-dc.badbundt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:30.650083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.648279+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 3, "frame_number": 7, "display_filter": "frame.number == 7", "timestamp_epoch": "1566329449.880862000" }, { "udp_stream": 4, "frame_number": 8, "display_filter": "frame.number == 8", "timestamp_epoch": "1566329449.881049000" }, { "udp_stream": 3, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1566329449.881124000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1566329449.881216000" }, { "udp_stream": 19, "frame_number": 389, "display_filter": "frame.number == 389", "timestamp_epoch": "1566329453.214843000" }, { "udp_stream": 19, "frame_number": 390, "display_filter": "frame.number == 390", "timestamp_epoch": "1566329453.215159000" }, { "udp_stream": 23, "frame_number": 403, "display_filter": "frame.number == 403", "timestamp_epoch": "1566329454.713695000" }, { "udp_stream": 23, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1566329454.714016000" }, { "udp_stream": 64, "frame_number": 10005, "display_filter": "frame.number == 10005", "timestamp_epoch": "1566330654.941768000" }, { "udp_stream": 64, "frame_number": 10006, "display_filter": "frame.number == 10006", "timestamp_epoch": "1566330654.942042000" }, { "udp_stream": 65, "frame_number": 10026, "display_filter": "frame.number == 10026", "timestamp_epoch": "1566330654.977069000" }, { "udp_stream": 65, "frame_number": 10027, "display_filter": "frame.number == 10027", "timestamp_epoch": "1566330654.977320000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:30.645991+00:00" }, { "observable_id": "observable-7500902792da74312c051183", "type": "domain", "value": "badbundt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.565579+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.388867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.384951+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1566329458.112209000" }, { "udp_stream": 27, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1566329458.112974000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:28.380418+00:00" }, { "observable_id": "observable-2872c2314796c8bd53b2d387", "type": "domain", "value": "bh79sbu.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:27.923919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:27.742983+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.738032+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 682, "display_filter": "frame.number == 682", "timestamp_epoch": "1566329493.324340000" }, { "udp_stream": 31, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1566329493.560314000" }, { "tcp_stream": 44, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1566329493.792567000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:27.732936+00:00" }, { "observable_id": "observable-30d4c230e12e9ee911a6c981", "type": "domain", "value": "boozzdigital.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:29.018266+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.016370+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 12664, "display_filter": "frame.number == 12664", "timestamp_epoch": "1566330702.438541000" }, { "udp_stream": 66, "frame_number": 12665, "display_filter": "frame.number == 12665", "timestamp_epoch": "1566330702.513714000" }, { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.013940+00:00" }, { "observable_id": "observable-3d0ecf3e285094d5d2fd3f9b", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 650, "display_filter": "frame.number == 650", "timestamp_epoch": "1566329465.460030000" }, { "udp_stream": 30, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1566329465.486337000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-65b4739f84faa9874ec8b661", "type": "domain", "value": "gmail.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:29.191751+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.187583+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1367, "display_filter": "frame.number == 1367", "timestamp_epoch": "1566329702.684441000" }, { "udp_stream": 38, "frame_number": 1368, "display_filter": "frame.number == 1368", "timestamp_epoch": "1566329702.707409000" }, { "tcp_stream": 53, "frame_number": 1375, "display_filter": "frame.number == 1375", "timestamp_epoch": "1566329702.734179000" }, { "tcp_stream": 54, "frame_number": 1376, "display_filter": "frame.number == 1376", "timestamp_epoch": "1566329702.734255000" }, { "tcp_stream": 60, "frame_number": 1994, "display_filter": "frame.number == 1994", "timestamp_epoch": "1566329796.596839000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.179467+00:00" }, { "observable_id": "observable-a27317ab40df8f093af1ba77", "type": "domain", "value": "google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:42.217118+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.384475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1322, "display_filter": "frame.number == 1322", "timestamp_epoch": "1566329681.389915000" }, { "udp_stream": 36, "frame_number": 1324, "display_filter": "frame.number == 1324", "timestamp_epoch": "1566329681.506167000" }, { "tcp_stream": 50, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1566329681.527712000" }, { "tcp_stream": 59, "frame_number": 1975, "display_filter": "frame.number == 1975", "timestamp_epoch": "1566329796.463128000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.378739+00:00" }, { "observable_id": "observable-f38b53e471f7f448f1c1b332", "type": "domain", "value": "hne53brianaea.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:29.396920+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.393366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 1444, "display_filter": "frame.number == 1444", "timestamp_epoch": "1566329723.938616000" }, { "udp_stream": 39, "frame_number": 1445, "display_filter": "frame.number == 1445", "timestamp_epoch": "1566329723.982026000" }, { "tcp_stream": 58, "frame_number": 1452, "display_filter": "frame.number == 1452", "timestamp_epoch": "1566329724.149645000" }, { "tcp_stream": 58, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1566329725.102711000" }, { "tcp_stream": 58, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1566329726.204629000" }, { "tcp_stream": 58, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1566329727.940226000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.389475+00:00" }, { "observable_id": "observable-24b96fd058243260fb469515", "type": "domain", "value": "idogoiania.com.br", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:29.585838+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.575912+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 53, "frame_number": 3246, "display_filter": "frame.number == 3246", "timestamp_epoch": "1566330403.320857000" }, { "udp_stream": 53, "frame_number": 3247, "display_filter": "frame.number == 3247", "timestamp_epoch": "1566330403.344480000" }, { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" }, { "tcp_stream": 73, "frame_number": 3258, "display_filter": "frame.number == 3258", "timestamp_epoch": "1566330403.494827000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.570419+00:00" }, { "observable_id": "observable-6033714c03577c9ccb9aa259", "type": "domain", "value": "isatap.badbundt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 20, "frame_number": 391, "display_filter": "frame.number == 391", "timestamp_epoch": "1566329453.229001000" }, { "udp_stream": 20, "frame_number": 392, "display_filter": "frame.number == 392", "timestamp_epoch": "1566329453.229263000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9f27c9c97627dfe83d1d81ce", "type": "domain", "value": "isatap.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 21, "frame_number": 393, "display_filter": "frame.number == 393", "timestamp_epoch": "1566329453.374157000" }, { "udp_stream": 21, "frame_number": 394, "display_filter": "frame.number == 394", "timestamp_epoch": "1566329453.374403000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6145d3a3fe4924ac0acbff5d", "type": "domain", "value": "kjoanaxbrennan.top", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:29.778856+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.776872+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 2011, "display_filter": "frame.number == 2011", "timestamp_epoch": "1566329806.704700000" }, { "udp_stream": 44, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1566329806.728922000" }, { "tcp_stream": 61, "frame_number": 2016, "display_filter": "frame.number == 2016", "timestamp_epoch": "1566329807.014331000" }, { "tcp_stream": 63, "frame_number": 2121, "display_filter": "frame.number == 2121", "timestamp_epoch": "1566330096.772646000" }, { "tcp_stream": 70, "frame_number": 3219, "display_filter": "frame.number == 3219", "timestamp_epoch": "1566330396.793237000" }, { "tcp_stream": 71, "frame_number": 3234, "display_filter": "frame.number == 3234", "timestamp_epoch": "1566330400.345365000" }, { "tcp_stream": 74, "frame_number": 4029, "display_filter": "frame.number == 4029", "timestamp_epoch": "1566330414.450514000" }, { "tcp_stream": 77, "frame_number": 4593, "display_filter": "frame.number == 4593", "timestamp_epoch": "1566330556.689758000" }, { "tcp_stream": 79, "frame_number": 4766, "display_filter": "frame.number == 4766", "timestamp_epoch": "1566330561.386285000" }, { "tcp_stream": 80, "frame_number": 4796, "display_filter": "frame.number == 4796", "timestamp_epoch": "1566330562.910490000" }, { "tcp_stream": 81, "frame_number": 5981, "display_filter": "frame.number == 5981", "timestamp_epoch": "1566330564.474323000" }, { "tcp_stream": 128, "frame_number": 12444, "display_filter": "frame.number == 12444", "timestamp_epoch": "1566330700.286861000" }, { "tcp_stream": 133, "frame_number": 13810, "display_filter": "frame.number == 13810", "timestamp_epoch": "1566330716.398453000" }, { "tcp_stream": 144, "frame_number": 17529, "display_filter": "frame.number == 17529", "timestamp_epoch": "1566331000.259793000" }, { "tcp_stream": 145, "frame_number": 17544, "display_filter": "frame.number == 17544", "timestamp_epoch": "1566331002.177022000" }, { "tcp_stream": 146, "frame_number": 17563, "display_filter": "frame.number == 17563", "timestamp_epoch": "1566331014.466484000" }, { "tcp_stream": 147, "frame_number": 17582, "display_filter": "frame.number == 17582", "timestamp_epoch": "1566331016.615305000" }, { "tcp_stream": 154, "frame_number": 18331, "display_filter": "frame.number == 18331", "timestamp_epoch": "1566331302.117270000" }, { "tcp_stream": 155, "frame_number": 18346, "display_filter": "frame.number == 18346", "timestamp_epoch": "1566331314.058492000" }, { "tcp_stream": 157, "frame_number": 18398, "display_filter": "frame.number == 18398", "timestamp_epoch": "1566331602.113804000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.774831+00:00" }, { "observable_id": "observable-0d1f5c055d4ec2c664cc8af5", "type": "domain", "value": "mail.protonmail.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:29.939540+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.936946+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 18571, "display_filter": "frame.number == 18571", "timestamp_epoch": "1566331706.334139000" }, { "udp_stream": 67, "frame_number": 18572, "display_filter": "frame.number == 18572", "timestamp_epoch": "1566331706.356424000" }, { "udp_stream": 68, "frame_number": 18605, "display_filter": "frame.number == 18605", "timestamp_epoch": "1566331707.347278000" }, { "udp_stream": 68, "frame_number": 18606, "display_filter": "frame.number == 18606", "timestamp_epoch": "1566331707.347774000" }, { "tcp_stream": 165, "frame_number": 18580, "display_filter": "frame.number == 18580", "timestamp_epoch": "1566331706.796137000" }, { "tcp_stream": 166, "frame_number": 18581, "display_filter": "frame.number == 18581", "timestamp_epoch": "1566331706.796557000" }, { "tcp_stream": 164, "frame_number": 18620, "display_filter": "frame.number == 18620", "timestamp_epoch": "1566331707.731554000" }, { "tcp_stream": 167, "frame_number": 18621, "display_filter": "frame.number == 18621", "timestamp_epoch": "1566331707.731808000" }, { "tcp_stream": 168, "frame_number": 18708, "display_filter": "frame.number == 18708", "timestamp_epoch": "1566331712.707683000" }, { "tcp_stream": 170, "frame_number": 18710, "display_filter": "frame.number == 18710", "timestamp_epoch": "1566331712.707971000" }, { "tcp_stream": 169, "frame_number": 18731, "display_filter": "frame.number == 18731", "timestamp_epoch": "1566331712.983119000" }, { "tcp_stream": 171, "frame_number": 18732, "display_filter": "frame.number == 18732", "timestamp_epoch": "1566331712.983373000" }, { "tcp_stream": 172, "frame_number": 18833, "display_filter": "frame.number == 18833", "timestamp_epoch": "1566331715.122500000" }, { "tcp_stream": 174, "frame_number": 18834, "display_filter": "frame.number == 18834", "timestamp_epoch": "1566331715.122670000" }, { "tcp_stream": 173, "frame_number": 18851, "display_filter": "frame.number == 18851", "timestamp_epoch": "1566331715.355376000" }, { "tcp_stream": 175, "frame_number": 18852, "display_filter": "frame.number == 18852", "timestamp_epoch": "1566331715.355555000" }, { "tcp_stream": 176, "frame_number": 18911, "display_filter": "frame.number == 18911", "timestamp_epoch": "1566331716.329521000" }, { "tcp_stream": 177, "frame_number": 18912, "display_filter": "frame.number == 18912", "timestamp_epoch": "1566331716.329711000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:29.934952+00:00" }, { "observable_id": "observable-cb2cfd5a30899afdd0e2fa31", "type": "domain", "value": "myip.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1969, "display_filter": "frame.number == 1969", "timestamp_epoch": "1566329796.285649000" }, { "udp_stream": 43, "frame_number": 1970, "display_filter": "frame.number == 1970", "timestamp_epoch": "1566329796.306864000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a06eb7adbdfa2f124719b814", "type": "domain", "value": "myip.opendns.com.badbundt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 1967, "display_filter": "frame.number == 1967", "timestamp_epoch": "1566329796.110953000" }, { "udp_stream": 42, "frame_number": 1968, "display_filter": "frame.number == 1968", "timestamp_epoch": "1566329796.162199000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-37e922845b036d15b22b06a6", "type": "domain", "value": "resolver1.opendns.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 1963, "display_filter": "frame.number == 1963", "timestamp_epoch": "1566329796.056738000" }, { "udp_stream": 40, "frame_number": 1964, "display_filter": "frame.number == 1964", "timestamp_epoch": "1566329796.089726000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-32df5a52781cbed85c85369c", "type": "domain", "value": "tampa-office-pc.badbundt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:30.823643+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.818238+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 419, "display_filter": "frame.number == 419", "timestamp_epoch": "1566329458.111159000" }, { "udp_stream": 26, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1566329458.111494000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:30.812607+00:00" }, { "observable_id": "observable-784acf2b9fdde67c65b66f0f", "type": "domain", "value": "wpad.badbundt.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 382, "display_filter": "frame.number == 382", "timestamp_epoch": "1566329453.107072000" }, { "udp_stream": 17, "frame_number": 383, "display_filter": "frame.number == 383", "timestamp_epoch": "1566329453.107285000" }, { "udp_stream": 33, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1566329681.344278000" }, { "udp_stream": 33, "frame_number": 1318, "display_filter": "frame.number == 1318", "timestamp_epoch": "1566329681.344602000" }, { "udp_stream": 61, "frame_number": 9398, "display_filter": "frame.number == 9398", "timestamp_epoch": "1566330632.760456000" }, { "udp_stream": 61, "frame_number": 9399, "display_filter": "frame.number == 9399", "timestamp_epoch": "1566330632.760705000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-93ab03860be98084d1d5af8d", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 34, "frame_number": 1319, "display_filter": "frame.number == 1319", "timestamp_epoch": "1566329681.344864000" }, { "udp_stream": 34, "frame_number": 1320, "display_filter": "frame.number == 1320", "timestamp_epoch": "1566329681.345121000" }, { "udp_stream": 62, "frame_number": 9400, "display_filter": "frame.number == 9400", "timestamp_epoch": "1566330632.761022000" }, { "udp_stream": 62, "frame_number": 9401, "display_filter": "frame.number == 9401", "timestamp_epoch": "1566330632.778985000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-783b1f363740606bcbbff02e", "type": "domain", "value": "www.download.windowsupdate.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:30.124643+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.120066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2024, "display_filter": "frame.number == 2024", "timestamp_epoch": "1566329807.511295000" }, { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" }, { "tcp_stream": 62, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1566329807.592332000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:30.114811+00:00" }, { "observable_id": "observable-d936b96dfb5314a188d494ec", "type": "domain", "value": "www.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:45.279334+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.312887+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 1336, "display_filter": "frame.number == 1336", "timestamp_epoch": "1566329681.632531000" }, { "udp_stream": 37, "frame_number": 1338, "display_filter": "frame.number == 1338", "timestamp_epoch": "1566329681.649446000" }, { "tcp_stream": 51, "frame_number": 1345, "display_filter": "frame.number == 1345", "timestamp_epoch": "1566329681.671214000" }, { "tcp_stream": 52, "frame_number": 1347, "display_filter": "frame.number == 1347", "timestamp_epoch": "1566329681.671312000" }, { "tcp_stream": 55, "frame_number": 1405, "display_filter": "frame.number == 1405", "timestamp_epoch": "1566329702.918816000" }, { "tcp_stream": 56, "frame_number": 1406, "display_filter": "frame.number == 1406", "timestamp_epoch": "1566329702.918961000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:30.306426+00:00" }, { "observable_id": "observable-048b4cb86793c2aedf30ecbf", "type": "domain", "value": "www.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:30.477224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.472841+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 408, "display_filter": "frame.number == 408", "timestamp_epoch": "1566329455.680831000" }, { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" }, { "tcp_stream": 27, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1566329455.750243000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:30.467899+00:00" }, { "observable_id": "observable-7914b9687e0a2660e2bff9e8", "type": "ipv4", "value": "10.8.20.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-645e5094052ac25736dc7f8b", "type": "ipv4", "value": "10.8.20.101", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 27, "frame_number": 421, "display_filter": "frame.number == 421", "timestamp_epoch": "1566329458.112209000" }, { "udp_stream": 27, "frame_number": 422, "display_filter": "frame.number == 422", "timestamp_epoch": "1566329458.112974000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2694a54aaa506930e5cce67f", "type": "ipv4", "value": "10.8.20.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c93be9b8d1bf6dc797a15403", "type": "ipv4", "value": "10.8.20.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1566329449.877379000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1566329449.878593000" }, { "udp_stream": 3, "frame_number": 9, "display_filter": "frame.number == 9", "timestamp_epoch": "1566329449.881124000" }, { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1566329449.881216000" }, { "udp_stream": 8, "frame_number": 63, "display_filter": "frame.number == 63", "timestamp_epoch": "1566329450.068849000" }, { "udp_stream": 10, "frame_number": 101, "display_filter": "frame.number == 101", "timestamp_epoch": "1566329450.079103000" }, { "udp_stream": 12, "frame_number": 181, "display_filter": "frame.number == 181", "timestamp_epoch": "1566329450.184657000" }, { "udp_stream": 19, "frame_number": 390, "display_filter": "frame.number == 390", "timestamp_epoch": "1566329453.215159000" }, { "udp_stream": 23, "frame_number": 404, "display_filter": "frame.number == 404", "timestamp_epoch": "1566329454.714016000" }, { "udp_stream": 26, "frame_number": 420, "display_filter": "frame.number == 420", "timestamp_epoch": "1566329458.111494000" }, { "udp_stream": 57, "frame_number": 8997, "display_filter": "frame.number == 8997", "timestamp_epoch": "1566330632.497685000" }, { "udp_stream": 64, "frame_number": 10006, "display_filter": "frame.number == 10006", "timestamp_epoch": "1566330654.942042000" }, { "udp_stream": 65, "frame_number": 10027, "display_filter": "frame.number == 10027", "timestamp_epoch": "1566330654.977320000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9a553af7f062327d334a966a", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1566329465.486337000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5d984e24ad0e151167b5c1e9", "type": "ipv4", "value": "139.198.5.65", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:31.025661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.023311+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 2134, "display_filter": "frame.number == 2134", "timestamp_epoch": "1566330099.301598000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:31.020338+00:00" }, { "observable_id": "observable-e25e628327ad51e2aa4a33ae", "type": "ipv4", "value": "170.238.117.187", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-09183bb881ce24b3835e0d8f", "rule_id": "sensitive-data-in-cleartext", "frame_number": 7772 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:25.460595+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:25.276882+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.274231+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 85, "frame_number": 6923, "display_filter": "frame.number == 6923", "timestamp_epoch": "1566330616.714903000" }, { "tcp_stream": 86, "frame_number": 7165, "display_filter": "frame.number == 7165", "timestamp_epoch": "1566330619.221754000" }, { "tcp_stream": 87, "frame_number": 7772, "display_filter": "frame.number == 7772", "timestamp_epoch": "1566330622.260866000" }, { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" }, { "tcp_stream": 152, "frame_number": 18243, "display_filter": "frame.number == 18243", "timestamp_epoch": "1566331165.717613000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:25.270653+00:00" }, { "observable_id": "observable-981a714d36e3fdd9264f0979", "type": "ipv4", "value": "172.217.6.133", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:31.208213+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.203258+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1368, "display_filter": "frame.number == 1368", "timestamp_epoch": "1566329702.707409000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:31.198591+00:00" }, { "observable_id": "observable-c0215af8fbf8ae796aeed1eb", "type": "ipv4", "value": "172.217.6.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:31.399217+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.397522+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1324, "display_filter": "frame.number == 1324", "timestamp_epoch": "1566329681.506167000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:31.393417+00:00" }, { "observable_id": "observable-034b80ab0dccddb8dd05c324", "type": "ipv4", "value": "172.217.9.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:31.598753+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.594519+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 37, "frame_number": 1338, "display_filter": "frame.number == 1338", "timestamp_epoch": "1566329681.649446000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:31.589371+00:00" }, { "observable_id": "observable-a77dcd1351c1c18b72c1fa8c", "type": "ipv4", "value": "173.166.146.112", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 1970, "display_filter": "frame.number == 1970", "timestamp_epoch": "1566329796.306864000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5f89639e9c64bd56156581bd", "type": "ipv4", "value": "185.117.75.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:31.779423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.777074+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:31.774739+00:00" }, { "observable_id": "observable-f0bbbac95635e8c7be0e6fb5", "type": "ipv4", "value": "185.183.98.232", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.152507+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:27.933398+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.928805+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 82, "frame_number": 6112, "display_filter": "frame.number == 6112", "timestamp_epoch": "1566330597.277074000" }, { "tcp_stream": 88, "frame_number": 7765, "display_filter": "frame.number == 7765", "timestamp_epoch": "1566330622.134171000" }, { "tcp_stream": 123, "frame_number": 10374, "display_filter": "frame.number == 10374", "timestamp_epoch": "1566330655.213787000" }, { "tcp_stream": 141, "frame_number": 16701, "display_filter": "frame.number == 16701", "timestamp_epoch": "1566330829.918742000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:27.923985+00:00" }, { "observable_id": "observable-07f01c94d13013435c8a9070", "type": "ipv4", "value": "185.193.141.166", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:31.985825+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.980414+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1566329806.728922000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:31.974910+00:00" }, { "observable_id": "observable-a9dc749174d403b84ad5014e", "type": "ipv4", "value": "185.248.87.88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:32.206747+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.202667+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 3001, "display_filter": "frame.number == 3001", "timestamp_epoch": "1566330133.355663000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:32.198200+00:00" }, { "observable_id": "observable-7adb3bbfc0a683bf830d1b38", "type": "ipv4", "value": "185.70.40.151", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:32.597440+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.592412+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 67, "frame_number": 18572, "display_filter": "frame.number == 18572", "timestamp_epoch": "1566331706.356424000" }, { "udp_stream": 68, "frame_number": 18606, "display_filter": "frame.number == 18606", "timestamp_epoch": "1566331707.347774000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:32.587314+00:00" }, { "observable_id": "observable-048cdd6f0b38901637449708", "type": "ipv4", "value": "191.37.181.152", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:32.801093+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.796885+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:32.791897+00:00" }, { "observable_id": "observable-1f1600b025b974237d45a23a", "type": "ipv4", "value": "192.185.170.206", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:32.994927+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.992990+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:32.990699+00:00" }, { "observable_id": "observable-ea07a8d8189caf7c90845915", "type": "ipv4", "value": "192.252.210.19", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-293052200eda7e4390f50794", "type": "ipv4", "value": "206.189.74.47", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:33.180671+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.178774+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 53, "frame_number": 3247, "display_filter": "frame.number == 3247", "timestamp_epoch": "1566330403.344480000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:33.176464+00:00" }, { "observable_id": "observable-f8fb4211fb318cbae2df8505", "type": "ipv4", "value": "208.67.222.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 1964, "display_filter": "frame.number == 1964", "timestamp_epoch": "1566329796.089726000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0881320bb00eca1180c20053", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a0ede5a807a52bdf7796e0b1", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ef5911fdfba56033010eec03", "type": "ipv4", "value": "23.200.143.27", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-881c798ca264c4202a3347d4", "type": "ipv4", "value": "23.200.143.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0606c275bff832fd5b0bb6aa", "type": "ipv4", "value": "23.200.143.41", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-235a358db2ca6096d1308573", "type": "ipv4", "value": "23.200.143.43", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1904be72ac7b74cb665a1b87", "type": "ipv4", "value": "23.200.143.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c41f2e4ab5ae54ae2d8ff669", "type": "ipv4", "value": "23.200.143.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c7e5c818531bb14a16e7137", "type": "ipv4", "value": "23.200.143.57", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d81c14f34c0a837fca3e70c5", "type": "ipv4", "value": "23.200.143.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:33.374978+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.373011+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:33.370717+00:00" }, { "observable_id": "observable-11544a7563a858e5742b5901", "type": "ipv4", "value": "23.200.143.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 2025, "display_filter": "frame.number == 2025", "timestamp_epoch": "1566329807.574008000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3161a4f30fee8ddb55ec2f7", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 1287, "display_filter": "frame.number == 1287", "timestamp_epoch": "1566329570.525266000" }, { "frame_number": 1297, "display_filter": "frame.number == 1297", "timestamp_epoch": "1566329570.863599000" }, { "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1566329573.535572000" }, { "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1566329573.862553000" }, { "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1566329576.545804000" }, { "frame_number": 1302, "display_filter": "frame.number == 1302", "timestamp_epoch": "1566329576.873927000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e15727ee89ede04ed5437319", "type": "ipv4", "value": "5.39.113.142", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:33.554485+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.551865+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:33.549516+00:00" }, { "observable_id": "observable-978a572fbfd4f85a3115bd16", "type": "ipv4", "value": "63.239.233.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e59b45ff49b62cfc7eb74ce4", "type": "ipv4", "value": "63.239.233.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-28065a24652efc8444512d3f", "type": "ipv4", "value": "63.239.233.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4af8d04affb3c8a0d744f153", "type": "ipv4", "value": "63.239.233.82", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-99ecda851e539d3e16d1e764", "type": "ipv4", "value": "63.239.233.83", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f268976e63e453aae5ba9b79", "type": "ipv4", "value": "63.239.233.84", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c66c4ebcd441dcaf2aea57d4", "type": "ipv4", "value": "63.239.233.90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:33.751357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.748499+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:33.744742+00:00" }, { "observable_id": "observable-01f2691f83187c060580aa14", "type": "ipv4", "value": "63.239.233.91", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-02092a219a160b493c6e94ef", "type": "ipv4", "value": "63.239.233.92", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 25, "frame_number": 409, "display_filter": "frame.number == 409", "timestamp_epoch": "1566329455.710994000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-383ce369310daf86ee18e3a5", "type": "ipv4", "value": "68.183.185.221", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:33.929567+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.926997+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 66, "frame_number": 12665, "display_filter": "frame.number == 12665", "timestamp_epoch": "1566330702.513714000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:33.924311+00:00" }, { "observable_id": "observable-76112c7ac88b5df439bc95c0", "type": "ipv4", "value": "89.105.203.184", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:34.115077+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:34.113046+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:34.110740+00:00" }, { "observable_id": "observable-228211530e98896a451e3445", "type": "ipv4", "value": "94.103.86.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:34.290716+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:34.288839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 39, "frame_number": 1445, "display_filter": "frame.number == 1445", "timestamp_epoch": "1566329723.982026000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:34.286648+00:00" }, { "observable_id": "observable-f94c7be5f2c58b077e2c0132", "type": "ipv4", "value": "94.103.87.160", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.380357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:28.158169+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.156442+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 683, "display_filter": "frame.number == 683", "timestamp_epoch": "1566329493.560314000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:28.152571+00:00" }, { "observable_id": "observable-c7f7b640aaeda2494cc3e7a0", "type": "sha256", "value": "218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8d8e25244e2ca72c91de4f93", "type": "sha256", "value": "30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e5f6869b7469a2aefb192795", "type": "sha256", "value": "351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8b1b649d4b10286e8a306087", "type": "sha256", "value": "4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:25.661073+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:25.465990+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.463518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:25.460644+00:00" }, { "observable_id": "observable-40ac3862c89d23dd7cb8919c", "type": "sha256", "value": "5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0ebed811d2e75888dc9c7525", "type": "sha256", "value": "5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0fb76c930d60b29dcae7c53", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e785586c76111fcd1ba88bd", "type": "sha256", "value": "7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5214352ee03f94c89a793ef2", "type": "sha256", "value": "9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-cb85ff6cff4451bcfbb76fd3", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 8566 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:26.277919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:26.040610+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.036610+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:26.031265+00:00" }, { "observable_id": "observable-eaa13037c8a79cf0dbdd1e48", "type": "sha256", "value": "9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5c4fc5a4c43e245cd3939d4", "type": "sha256", "value": "b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fbe1b80b9c849b168869db7a", "type": "sha256", "value": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-a709cdf7664add74a5670a6c", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 6851, 17479 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:26.823819+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:26.643576+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.638749+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:26.631473+00:00" }, { "observable_id": "observable-a26b0b7869a3632d32df10a8", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-159e0358482d1e27b62a5ff6", "type": "sha256", "value": "dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f503b8d1b7fcfcd58e757727", "type": "sha256", "value": "ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a74e1291762848dbd452a0c0", "type": "sha256", "value": "df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-12b62c6850003db2362a7f92", "type": "sha256", "value": "e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "static-review", "artifact_id": "artifact-c57ae597edfeec3101feee66", "features": [ "pe-bytes-under-non-executable-url-extension" ], "frames": [ 11294 ], "interpretation": "A transfer-bound PE is served under a non-executable URL extension. Investigate the exact recovered hash; this is not proof of execution or a transitive hosting-IP verdict." } ], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:27.367399+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:46:27.177782+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.176033+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:46:27.173841+00:00" }, { "observable_id": "observable-a9ea059ae6b54d0ed67b6a44", "type": "sha256", "value": "e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b242e8f838f2496b976cd57c", "type": "sha256", "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e6f54acfa8d90eb146d98520", "type": "sha256", "value": "edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0b15d387477f0d3e1e566f1d", "type": "sha256", "value": "f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ebe9bf7870e376be70e8a5bb", "type": "url", "value": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/81/", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-09183bb881ce24b3835e0d8f", "rule_id": "sensitive-data-in-cleartext", "frame_number": 7772 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 85, "frame_number": 6923, "display_filter": "frame.number == 6923", "timestamp_epoch": "1566330616.714903000" }, { "tcp_stream": 87, "frame_number": 7772, "display_filter": "frame.number == 7772", "timestamp_epoch": "1566330622.260866000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab3b0f5a4c87f27be6882fd2", "type": "url", "value": "http://170.238.117.187/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/83/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 86, "frame_number": 7165, "display_filter": "frame.number == 7165", "timestamp_epoch": "1566330619.221754000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75136e90c02077832baed5bd", "type": "url", "value": "http://170.238.117.187:8082/leo3/TAMPA-OFFICE-PC_W617601.ED4782C345F87239758E6C1922A1FC2A/90", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 99, "frame_number": 9414, "display_filter": "frame.number == 9414", "timestamp_epoch": "1566330633.083564000" }, { "tcp_stream": 152, "frame_number": 18243, "display_filter": "frame.number == 18243", "timestamp_epoch": "1566331165.717613000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2b05789e9a2a774b77f8717f", "type": "url", "value": "http://185.183.98.232/samerton.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 82, "frame_number": 6112, "display_filter": "frame.number == 6112", "timestamp_epoch": "1566330597.277074000" }, { "tcp_stream": 141, "frame_number": 16701, "display_filter": "frame.number == 16701", "timestamp_epoch": "1566330829.918742000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-742f1fdabf6930de1b805ead", "type": "url", "value": "http://185.183.98.232/tablone.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 88, "frame_number": 7765, "display_filter": "frame.number == 7765", "timestamp_epoch": "1566330622.134171000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ed9df9285aa0953fa4f363c5", "type": "url", "value": "http://185.183.98.232/wredneg2.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 123, "frame_number": 10374, "display_filter": "frame.number == 10374", "timestamp_epoch": "1566330655.213787000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-546ab98d58759584caf9506f", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 1287, "display_filter": "frame.number == 1287", "timestamp_epoch": "1566329570.525266000" }, { "frame_number": 1297, "display_filter": "frame.number == 1297", "timestamp_epoch": "1566329570.863599000" }, { "frame_number": 1299, "display_filter": "frame.number == 1299", "timestamp_epoch": "1566329573.535572000" }, { "frame_number": 1300, "display_filter": "frame.number == 1300", "timestamp_epoch": "1566329573.862553000" }, { "frame_number": 1301, "display_filter": "frame.number == 1301", "timestamp_epoch": "1566329576.545804000" }, { "frame_number": 1302, "display_filter": "frame.number == 1302", "timestamp_epoch": "1566329576.873927000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4fe73d4d7fcd3c22cc1b957", "type": "url", "value": "http://activity.qingcloud.com/wp-content/uploads/2019/08/4antifreeze.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 64, "frame_number": 2138, "display_filter": "frame.number == 2138", "timestamp_epoch": "1566330099.486377000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9f4c5f74781d6f441db81014", "type": "url", "value": "http://bh79sbu.com/qtra/ttqr.php?l=csuv3.j12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 44, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1566329493.792567000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b30b39322442412106725bc0", "type": "url", "value": "http://boozzdigital.com/wp-content/uploads/2019/08/antifreeze.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 130, "frame_number": 12669, "display_filter": "frame.number == 12669", "timestamp_epoch": "1566330702.734890000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06bfc7eebc287ca176637765", "type": "url", "value": "http://google.com/images/wf_2BKr4G/FBs5faKhKo1Pnp08vMzq/zibGUzrNNpWqxTjIQAm/0UsHGbO79hlbB2A_2Fmfp7/oeErI2s2po_2F/Ew1zMmbp/HYA_2FMNo72ovThdaTAFCKZ/F_2Fgr52xx/INU2H6UvE7ymvIKxb/mkd8Oo3v8L/PDvnJk4t/5.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 50, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1566329681.527712000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ce9949e7aa600eb01313103", "type": "url", "value": "http://hne53brianaea.com/favicon.ico", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 1680, "display_filter": "frame.number == 1680", "timestamp_epoch": "1566329725.102711000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6bd5114c51fbaf19900b2627", "type": "url", "value": "http://hne53brianaea.com/images/h653rH6w/PilH9z95laHTcP4MnRhOF9A/GeqX26wnaS/8YsyasDcXWQnnOMko/S6uKPuADuGk1/GbwJRt1t6UV/9L7tclt9q8RKbN/nKvYej68gPCBsWo1AC8PG/zwuJlrXp_2BFY8aa/Wmq5wBLW2hZ/SJKwDfhn/z.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 1452, "display_filter": "frame.number == 1452", "timestamp_epoch": "1566329724.149645000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1080ef1b0bcdadd88a8783e", "type": "url", "value": "http://hne53brianaea.com/images/jBsO54_2BSa5oBENEZ/EttkU7CFn/gj86aodttq4SGqKGzI8r/dkGLgHKXE_2BCYPc_2B/iz9iP_2FaGl7POu9Q7UWta/CDXs918WF_2BF/NgpZ3Loa/T7ptv50ZZZPVti6x2VR9_2B/OwLBeSK3mK/uo61MerYr/iiYLwjLUCx/L.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 1954, "display_filter": "frame.number == 1954", "timestamp_epoch": "1566329727.940226000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01b0ece8e9914c53ab136c45", "type": "url", "value": "http://hne53brianaea.com/images/uZD5Vn6mhixGDQdr/CNcGJS5C1Di8ksv/zwHUQAnlhtaYx_2FLC/6esXCGihE/bHH3S8sftmF6_2B9Ny2K/x48gu_2B14EZ7uhi8bQ/F_2B9mEQMX0NlsNC66yxvT/qzTg6I9y1jLbi/MwHlxPrj/7zNB6tboXVnpuxQ/lux.avi", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 1688, "display_filter": "frame.number == 1688", "timestamp_epoch": "1566329726.204629000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-772bb01dec7f3dcdbf7d9062", "type": "url", "value": "http://idogoiania.com.br/wp-content/uploads/2019/08/3antifreeze.rar", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 72, "frame_number": 3251, "display_filter": "frame.number == 3251", "timestamp_epoch": "1566330403.397584000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d353112873da665b36ac94b5", "type": "url", "value": "http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 62, "frame_number": 2029, "display_filter": "frame.number == 2029", "timestamp_epoch": "1566329807.592332000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-83cd06657fc3cb22082e7071", "type": "url", "value": "http://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 51, "frame_number": 1345, "display_filter": "frame.number == 1345", "timestamp_epoch": "1566329681.671214000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7f2b85013fd63c77c8a5f31", "type": "url", "value": "http://www.google.com/images/errors/robot.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 52, "frame_number": 1347, "display_filter": "frame.number == 1347", "timestamp_epoch": "1566329681.671312000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db27f03e9551a20d1b466a1f", "type": "url", "value": "http://www.msftncsi.com/ncsi.txt", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 27, "frame_number": 413, "display_filter": "frame.number == 413", "timestamp_epoch": "1566329455.750243000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 113, "suspicious": 5 }, "ioc_candidate_count": 5, "summary": "118 typed observations; 5 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-c7f7b640aaeda2494cc3e7a0", "type": "sha256", "value": "218ce44363d0cb8f796516b7ac82a1a4c954180e3812f0132b980d1dd8d80b30", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8d8e25244e2ca72c91de4f93", "type": "sha256", "value": "30fd75a4145f34796f96751ad0d4a9b4a68cd912837898e97b457b784f452844", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5f6869b7469a2aefb192795", "type": "sha256", "value": "351bcc3ce30cfc63cbc9d8b9232208e740484512b1179cfb4ab4e9c681a01e15", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-40ac3862c89d23dd7cb8919c", "type": "sha256", "value": "5ba7b52dabd5187908201049ebfa82a3feb5d240d6612c617179a4f807c53953", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0ebed811d2e75888dc9c7525", "type": "sha256", "value": "5f9fc5b3fbddf0e72c5c56cdcfc81c6e10c617d70b1b93fbe1e4679a8797bff7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0fb76c930d60b29dcae7c53", "type": "sha256", "value": "6137f8db2192e638e13610f75e73b9247c05f4706f0afd1fdb132d86de6b4012", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e785586c76111fcd1ba88bd", "type": "sha256", "value": "7e0630e9c468031329cad1a21bfb37c12153bda0f4d6298ee1b8682dd0c35f8a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eaa13037c8a79cf0dbdd1e48", "type": "sha256", "value": "9f5d45c7cee3b8e576104001b198570fa2652c398de03a4c7d536031727acccc", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5c4fc5a4c43e245cd3939d4", "type": "sha256", "value": "b20e94d34f1c64a5740e68681957444eca3e9fa019b5e92ddf8f9debad2e6d23", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a26b0b7869a3632d32df10a8", "type": "sha256", "value": "c76ea8b0db60dcccfdc0217059e37eb5b10d10940e649f9bc1d07d4ddcc797d1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-159e0358482d1e27b62a5ff6", "type": "sha256", "value": "dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f503b8d1b7fcfcd58e757727", "type": "sha256", "value": "ddc8b3cd10cded2626cbf8d45b4bf82b30a4f923b87ad56351a6a71b9f268aeb", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a74e1291762848dbd452a0c0", "type": "sha256", "value": "df2b2b141f5509c084936ae12d251ea6531d6e27c7697146d2a6fd52b015c742", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9ea059ae6b54d0ed67b6a44", "type": "sha256", "value": "e4b68527b945f882b9a7c08f19c2f50154a67f4a0d4919996c25edeba1b564c1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b242e8f838f2496b976cd57c", "type": "sha256", "value": "e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e6f54acfa8d90eb146d98520", "type": "sha256", "value": "edd6ccb07e395c60e4aed91355fb3400d86065f011067748395313035161b437", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0b15d387477f0d3e1e566f1d", "type": "sha256", "value": "f0e8e0917df9af222f9869bfcb476687dd9e3c59099a619cac6bc843ed028c93", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7b118f35525990a90dc785ca", "type": "domain", "value": "112.146.166.173.b.barracudacentral.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-04c5ce19f7b8e111cc8386a8", "type": "domain", "value": "112.146.166.173.cbl.abuseat.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-75033825e0b5c6ed327f0acc", "type": "domain", "value": "112.146.166.173.dnsbl-1.uceprotect.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d98cecfde589f5b088e9d9c", "type": "domain", "value": "112.146.166.173.spam.dnsbl.sorbs.net", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d545cfd6cf9d85335bfbcefe", "type": "domain", "value": "112.146.166.173.zen.spamhaus.org", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d0ecf3e285094d5d2fd3f9b", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6033714c03577c9ccb9aa259", "type": "domain", "value": "isatap.badbundt.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9f27c9c97627dfe83d1d81ce", "type": "domain", "value": "isatap.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cb2cfd5a30899afdd0e2fa31", "type": "domain", "value": "myip.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a06eb7adbdfa2f124719b814", "type": "domain", "value": "myip.opendns.com.badbundt.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-37e922845b036d15b22b06a6", "type": "domain", "value": "resolver1.opendns.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-784acf2b9fdde67c65b66f0f", "type": "domain", "value": "wpad.badbundt.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-93ab03860be98084d1d5af8d", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a553af7f062327d334a966a", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a77dcd1351c1c18b72c1fa8c", "type": "ipv4", "value": "173.166.146.112", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ea07a8d8189caf7c90845915", "type": "ipv4", "value": "192.252.210.19", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8fb4211fb318cbae2df8505", "type": "ipv4", "value": "208.67.222.222", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef5911fdfba56033010eec03", "type": "ipv4", "value": "23.200.143.27", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-881c798ca264c4202a3347d4", "type": "ipv4", "value": "23.200.143.35", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0606c275bff832fd5b0bb6aa", "type": "ipv4", "value": "23.200.143.41", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-235a358db2ca6096d1308573", "type": "ipv4", "value": "23.200.143.43", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1904be72ac7b74cb665a1b87", "type": "ipv4", "value": "23.200.143.50", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c41f2e4ab5ae54ae2d8ff669", "type": "ipv4", "value": "23.200.143.56", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0c7e5c818531bb14a16e7137", "type": "ipv4", "value": "23.200.143.57", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-11544a7563a858e5742b5901", "type": "ipv4", "value": "23.200.143.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-978a572fbfd4f85a3115bd16", "type": "ipv4", "value": "63.239.233.68", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e59b45ff49b62cfc7eb74ce4", "type": "ipv4", "value": "63.239.233.75", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-28065a24652efc8444512d3f", "type": "ipv4", "value": "63.239.233.76", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4af8d04affb3c8a0d744f153", "type": "ipv4", "value": "63.239.233.82", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-99ecda851e539d3e16d1e764", "type": "ipv4", "value": "63.239.233.83", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f268976e63e453aae5ba9b79", "type": "ipv4", "value": "63.239.233.84", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01f2691f83187c060580aa14", "type": "ipv4", "value": "63.239.233.91", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-02092a219a160b493c6e94ef", "type": "ipv4", "value": "63.239.233.92", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e25e628327ad51e2aa4a33ae", "type": "ipv4", "value": "170.238.117.187", "priority": 100, "reasons": [ "existing-evidence-candidate", "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-5214352ee03f94c89a793ef2", "type": "sha256", "value": "9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-fbe1b80b9c849b168869db7a", "type": "sha256", "value": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-12b62c6850003db2362a7f92", "type": "sha256", "value": "e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224", "priority": 100, "reasons": [ "existing-evidence-candidate", "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-8b1b649d4b10286e8a306087", "type": "sha256", "value": "4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2872c2314796c8bd53b2d387", "type": "domain", "value": "bh79sbu.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f0bbbac95635e8c7be0e6fb5", "type": "ipv4", "value": "185.183.98.232", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f94c7be5f2c58b077e2c0132", "type": "ipv4", "value": "94.103.87.160", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7500902792da74312c051183", "type": "domain", "value": "badbundt.com", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dc71d5790d2c28104961b508", "type": "domain", "value": "activity.qingcloud.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-664eb442fe2727bedc1ba074", "type": "domain", "value": "api.ip.sb", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-30d4c230e12e9ee911a6c981", "type": "domain", "value": "boozzdigital.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-65b4739f84faa9874ec8b661", "type": "domain", "value": "gmail.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a27317ab40df8f093af1ba77", "type": "domain", "value": "google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f38b53e471f7f448f1c1b332", "type": "domain", "value": "hne53brianaea.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24b96fd058243260fb469515", "type": "domain", "value": "idogoiania.com.br", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6145d3a3fe4924ac0acbff5d", "type": "domain", "value": "kjoanaxbrennan.top", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0d1f5c055d4ec2c664cc8af5", "type": "domain", "value": "mail.protonmail.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-783b1f363740606bcbbff02e", "type": "domain", "value": "www.download.windowsupdate.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d936b96dfb5314a188d494ec", "type": "domain", "value": "www.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-048b4cb86793c2aedf30ecbf", "type": "domain", "value": "www.msftncsi.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6528a0d7e0f23e9d004d116f", "type": "domain", "value": "badbundt-dc.badbundt.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-32df5a52781cbed85c85369c", "type": "domain", "value": "tampa-office-pc.badbundt.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5d984e24ad0e151167b5c1e9", "type": "ipv4", "value": "139.198.5.65", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-981a714d36e3fdd9264f0979", "type": "ipv4", "value": "172.217.6.133", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c0215af8fbf8ae796aeed1eb", "type": "ipv4", "value": "172.217.6.174", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-034b80ab0dccddb8dd05c324", "type": "ipv4", "value": "172.217.9.132", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5f89639e9c64bd56156581bd", "type": "ipv4", "value": "185.117.75.41", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-07f01c94d13013435c8a9070", "type": "ipv4", "value": "185.193.141.166", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a9dc749174d403b84ad5014e", "type": "ipv4", "value": "185.248.87.88", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7adb3bbfc0a683bf830d1b38", "type": "ipv4", "value": "185.70.40.151", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-048cdd6f0b38901637449708", "type": "ipv4", "value": "191.37.181.152", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1f1600b025b974237d45a23a", "type": "ipv4", "value": "192.185.170.206", "priority": 45, "reasons": [ "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-293052200eda7e4390f50794", "type": "ipv4", "value": "206.189.74.47", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d81c14f34c0a837fca3e70c5", "type": "ipv4", "value": "23.200.143.72", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e15727ee89ede04ed5437319", "type": "ipv4", "value": "5.39.113.142", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c66c4ebcd441dcaf2aea57d4", "type": "ipv4", "value": "63.239.233.90", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-383ce369310daf86ee18e3a5", "type": "ipv4", "value": "68.183.185.221", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76112c7ac88b5df439bc95c0", "type": "ipv4", "value": "89.105.203.184", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-228211530e98896a451e3445", "type": "ipv4", "value": "94.103.86.146", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 90, "next_batch": [ "observable-c7f7b640aaeda2494cc3e7a0", "observable-8d8e25244e2ca72c91de4f93", "observable-e5f6869b7469a2aefb192795", "observable-40ac3862c89d23dd7cb8919c", "observable-0ebed811d2e75888dc9c7525", "observable-c0fb76c930d60b29dcae7c53", "observable-4e785586c76111fcd1ba88bd", "observable-eaa13037c8a79cf0dbdd1e48", "observable-f5c4fc5a4c43e245cd3939d4", "observable-a26b0b7869a3632d32df10a8" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "6a1182c395abfda3583ee13c9ffa47a957f53d7293dc6062b516f5b47557d30e" }, "enrichment": { "items": [ { "type": "ipv4", "value": "94.103.86.146", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:34.290716+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:34.288839+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:34.286648+00:00", "observable_id": "observable-228211530e98896a451e3445" }, { "type": "ipv4", "value": "89.105.203.184", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:34.115077+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:34.113046+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:34.110740+00:00", "observable_id": "observable-76112c7ac88b5df439bc95c0" }, { "type": "ipv4", "value": "68.183.185.221", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.929567+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.926997+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:33.924311+00:00", "observable_id": "observable-383ce369310daf86ee18e3a5" }, { "type": "ipv4", "value": "63.239.233.90", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.751357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.748499+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:33.744742+00:00", "observable_id": "observable-c66c4ebcd441dcaf2aea57d4" }, { "type": "ipv4", "value": "5.39.113.142", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.554485+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.551865+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:33.549516+00:00", "observable_id": "observable-e15727ee89ede04ed5437319" }, { "type": "ipv4", "value": "23.200.143.72", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.374978+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.373011+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:33.370717+00:00", "observable_id": "observable-d81c14f34c0a837fca3e70c5" }, { "type": "ipv4", "value": "206.189.74.47", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.180671+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:33.178774+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:33.176464+00:00", "observable_id": "observable-293052200eda7e4390f50794" }, { "type": "ipv4", "value": "192.185.170.206", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.994927+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.992990+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:32.990699+00:00", "observable_id": "observable-1f1600b025b974237d45a23a" }, { "type": "ipv4", "value": "191.37.181.152", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.801093+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.796885+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:32.791897+00:00", "observable_id": "observable-048cdd6f0b38901637449708" }, { "type": "ipv4", "value": "185.70.40.151", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.597440+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.592412+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:32.587314+00:00", "observable_id": "observable-7adb3bbfc0a683bf830d1b38" }, { "type": "ipv4", "value": "185.248.87.88", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.206747+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:32.202667+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:32.198200+00:00", "observable_id": "observable-a9dc749174d403b84ad5014e" }, { "type": "ipv4", "value": "185.193.141.166", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.985825+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.980414+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:31.974910+00:00", "observable_id": "observable-07f01c94d13013435c8a9070" }, { "type": "ipv4", "value": "185.117.75.41", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.779423+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.777074+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:31.774739+00:00", "observable_id": "observable-5f89639e9c64bd56156581bd" }, { "type": "ipv4", "value": "172.217.9.132", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.598753+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.594519+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:31.589371+00:00", "observable_id": "observable-034b80ab0dccddb8dd05c324" }, { "type": "ipv4", "value": "172.217.6.174", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.399217+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.397522+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:31.393417+00:00", "observable_id": "observable-c0215af8fbf8ae796aeed1eb" }, { "type": "ipv4", "value": "172.217.6.133", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.208213+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.203258+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:31.198591+00:00", "observable_id": "observable-981a714d36e3fdd9264f0979" }, { "type": "ipv4", "value": "139.198.5.65", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.025661+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:31.023311+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:31.020338+00:00", "observable_id": "observable-5d984e24ad0e151167b5c1e9" }, { "type": "domain", "value": "tampa-office-pc.badbundt.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.823643+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.818238+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:30.812607+00:00", "observable_id": "observable-32df5a52781cbed85c85369c" }, { "type": "domain", "value": "badbundt-dc.badbundt.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.650083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.648279+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:30.645991+00:00", "observable_id": "observable-6528a0d7e0f23e9d004d116f" }, { "type": "domain", "value": "www.msftncsi.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.477224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.472841+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:30.467899+00:00", "observable_id": "observable-048b4cb86793c2aedf30ecbf" }, { "type": "domain", "value": "www.google.com", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:45.279334+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.312887+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:30.306426+00:00", "observable_id": "observable-d936b96dfb5314a188d494ec" }, { "type": "domain", "value": "www.download.windowsupdate.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.124643+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:30.120066+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:30.114811+00:00", "observable_id": "observable-783b1f363740606bcbbff02e" }, { "type": "domain", "value": "mail.protonmail.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.939540+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.936946+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.934952+00:00", "observable_id": "observable-0d1f5c055d4ec2c664cc8af5" }, { "type": "domain", "value": "kjoanaxbrennan.top", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.778856+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.776872+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.774831+00:00", "observable_id": "observable-6145d3a3fe4924ac0acbff5d" }, { "type": "domain", "value": "idogoiania.com.br", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.585838+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.575912+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.570419+00:00", "observable_id": "observable-24b96fd058243260fb469515" }, { "type": "domain", "value": "hne53brianaea.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.396920+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.393366+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.389475+00:00", "observable_id": "observable-f38b53e471f7f448f1c1b332" }, { "type": "domain", "value": "google.com", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:42.217118+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.384475+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.378739+00:00", "observable_id": "observable-a27317ab40df8f093af1ba77" }, { "type": "domain", "value": "gmail.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.191751+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.187583+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.179467+00:00", "observable_id": "observable-65b4739f84faa9874ec8b661" }, { "type": "domain", "value": "boozzdigital.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.018266+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:29.016370+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:29.013940+00:00", "observable_id": "observable-30d4c230e12e9ee911a6c981" }, { "type": "domain", "value": "api.ip.sb", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.842815+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.840062+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:28.837207+00:00", "observable_id": "observable-664eb442fe2727bedc1ba074" }, { "type": "domain", "value": "activity.qingcloud.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.753688+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.575917+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.571352+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:28.565664+00:00", "observable_id": "observable-dc71d5790d2c28104961b508" }, { "type": "domain", "value": "badbundt.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.565579+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.388867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.384951+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:28.380418+00:00", "observable_id": "observable-7500902792da74312c051183" }, { "type": "ipv4", "value": "94.103.87.160", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.380357+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.158169+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.156442+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:28.152571+00:00", "observable_id": "observable-f94c7be5f2c58b077e2c0132" }, { "type": "ipv4", "value": "185.183.98.232", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:28.152507+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.933398+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.928805+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:27.923985+00:00", "observable_id": "observable-f0bbbac95635e8c7be0e6fb5" }, { "type": "domain", "value": "bh79sbu.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.923919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.742983+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.738032+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:27.732936+00:00", "observable_id": "observable-2872c2314796c8bd53b2d387" }, { "type": "sha256", "value": "e24925c9aa1281bd6f67109404b716591e444ce8d18e1056a589125ff6805224", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.367399+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.177782+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:27.176033+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:27.173841+00:00", "observable_id": "observable-12b62c6850003db2362a7f92" }, { "type": "sha256", "value": "c3477f3515c1bee5367cf0183883fc08e5edb40db40250b16b5fafba9875c582", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.823819+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.643576+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.638749+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:26.631473+00:00", "observable_id": "observable-fbe1b80b9c849b168869db7a" }, { "type": "sha256", "value": "9a5025c9388306f0988138cd0f7b7b0318d06307c5f50f7fc44b2692da647345", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.277919+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.040610+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:26.036610+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:26.031265+00:00", "observable_id": "observable-5214352ee03f94c89a793ef2" }, { "type": "sha256", "value": "4d929f61b964a7683ff3f2cea3a79f3f240c199a3593660620a331d8d8e80afc", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.661073+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.465990+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.463518+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:25.460644+00:00", "observable_id": "observable-8b1b649d4b10286e8a306087" }, { "type": "ipv4", "value": "170.238.117.187", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.460595+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.276882+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:46:25.274231+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:46:25.270653+00:00", "observable_id": "observable-e25e628327ad51e2aa4a33ae" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-7adb3bbfc0a683bf830d1b38" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-7adb3bbfc0a683bf830d1b38" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-048cdd6f0b38901637449708" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-048cdd6f0b38901637449708" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-1f1600b025b974237d45a23a" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-1f1600b025b974237d45a23a" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-293052200eda7e4390f50794" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-293052200eda7e4390f50794" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-d81c14f34c0a837fca3e70c5" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-d81c14f34c0a837fca3e70c5" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-e15727ee89ede04ed5437319" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-e15727ee89ede04ed5437319" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-c66c4ebcd441dcaf2aea57d4" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-c66c4ebcd441dcaf2aea57d4" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-383ce369310daf86ee18e3a5" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-383ce369310daf86ee18e3a5" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-76112c7ac88b5df439bc95c0" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-76112c7ac88b5df439bc95c0" }, { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-228211530e98896a451e3445" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-228211530e98896a451e3445" } ], "batch_targets": 10, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 40, "full_urls_disclosed": 0, "provider_lookups_started": 10 }, "updated_at": "2026-09-22T17:46:34.477594+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "86b346b0a7d28bcf26a3b2351bb2f91788ec860bab5f099312ac89cb5a8492f6", "source_semantic_sha256": "5dd91a89918e17e233f059f813a3ad75e87ad19e9200974e28e6d937749daa60", "previous_snapshot_sha256": "61fa238be14a1557b36a3a75137c5183ef6b1fe45d1a4738fda0e48a910a894d" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 5694, "evidence_end": 5721, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }