{ "analysis_id": "05851801-c224-489b-b9da-9e5d035c60b4", "session_id": "c1e69ddc-85b8-4193-a6be-6bca5518f9df", "status": "completed", "filename": "2020-01-30-traffic-analysis-exercise.pcap", "source_sha256": "51c84227023072a05ed3b4cae03662c7df80780551b6119c8af97301472642d4", "source_size_bytes": 8609402, "schema_version": "pcap-analysis-v1", "semantic_sha256": "058c1af6f71cde55e06a5ff1ac15ceb6974d302dcb74abe1bc455994ba1d18e4", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 13504 packets across 45 IP endpoints and 261 transport flows. Observed 166 DNS events, 85 HTTP requests, 39 TLS ClientHello events, and 70 recovered file/message object(s). Deterministic rules produced 24 finding(s): 0 high, 18 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2020-01-30-traffic-analysis-exercise.pcap\nCapture SHA-256: `51c84227023072a05ed3b4cae03662c7df80780551b6119c8af97301472642d4`\nSemantic result SHA-256: `058c1af6f71cde55e06a5ff1ac15ceb6974d302dcb74abe1bc455994ba1d18e4`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 13504 packets across 45 IP endpoints and 261 transport flows. Observed 166 DNS events, 85 HTTP requests, 39 TLS ClientHello events, and 70 recovered file/message object(s). Deterministic rules produced 24 finding(s): 0 high, 18 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 13504\n- Duration: 569.849989 seconds\n- Captured bytes: 8393314\n- Endpoints: 45\n- Flows: 261\n\n## Deterministic findings\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 1169 / TCP stream 55, frame 1235 / TCP stream 55.\n\nMetrics: `{\"content_type\":\"application/octet-stream\",\"declared_body_bytes\":81920,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"49.51.133.162\",\"uri\":\"/sv.exe\"}`\n\n### MEDIUM — Repeated outbound HTTP POST activity\n\nThe same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.\n\nRule: `repeated-http-posts@pcap-rules-v5`; confidence: 0.72; evidence: frame 1251 / TCP stream 57, frame 7711 / TCP stream 70, frame 7823 / TCP stream 76, frame 7916 / TCP stream 80, frame 12855 / TCP stream 127.\n\nMetrics: `{\"declared_body_bytes\":675,\"destination\":\"81.177.6.156\",\"host\":\"twereptale.com\",\"port\":80,\"request_count\":5,\"source\":\"10.20.30.227\",\"uri\":\"/4/forum.php\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 9976 / TCP stream 108, frame 10081 / TCP stream 108.\n\nMetrics: `{\"content_type\":\"text/javascript;charset=utf-8\",\"declared_body_bytes\":7489,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"104.81.85.107\",\"uri\":\"/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 9991 / TCP stream 109, frame 10744 / TCP stream 109.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":424648,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"104.97.213.249\",\"uri\":\"/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 9993 / TCP stream 112, frame 10645 / TCP stream 112.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":342081,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"104.97.213.249\",\"uri\":\"/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 9995 / TCP stream 110, frame 10068 / TCP stream 110.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":14928,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"104.97.213.249\",\"uri\":\"/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js\"}`\n\n### MEDIUM — Authentication-like token in cleartext HTTP URI\n\nAn HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.\n\nRule: `cleartext-tokenized-api@pcap-rules-v5`; confidence: 0.8; evidence: frame 12989 / TCP stream 134.\n\nMetrics: `{\"destination\":\"172.217.9.170\",\"host\":\"maps.googleapis.com\",\"path\":\"/maps/api/js\",\"request_count\":1,\"source\":\"10.20.30.227\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13042 / TCP stream 134, frame 13084 / TCP stream 134.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":28564,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/common.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13052 / TCP stream 135, frame 13163 / TCP stream 135.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":53979,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/util.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13054 / TCP stream 137, frame 13121 / TCP stream 137.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":16283,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/map.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13056 / TCP stream 136, frame 13093 / TCP stream 136.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":11505,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/marker.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13167 / TCP stream 135, frame 13178 / TCP stream 135.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":9135,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/onion.js\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13169 / TCP stream 137, frame 13181 / TCP stream 137.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":1711,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/stats.js\"}`\n\n### MEDIUM — Authentication-like token in cleartext HTTP URI\n\nAn HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.\n\nRule: `cleartext-tokenized-api@pcap-rules-v5`; confidence: 0.8; evidence: frame 13187 / TCP stream 135.\n\nMetrics: `{\"destination\":\"172.217.9.170\",\"host\":\"maps.googleapis.com\",\"path\":\"/maps/api/js/ViewportInfoService.GetViewportInfo\",\"request_count\":1,\"source\":\"10.20.30.227\"}`\n\n### MEDIUM — Authentication-like token in cleartext HTTP URI\n\nAn HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.\n\nRule: `cleartext-tokenized-api@pcap-rules-v5`; confidence: 0.8; evidence: frame 13360 / TCP stream 135, frame 13362 / TCP stream 137, frame 13364 / TCP stream 136, frame 13366 / TCP stream 134, frame 13377 / TCP stream 146.\n\nMetrics: `{\"destination\":\"172.217.9.170\",\"host\":\"maps.googleapis.com\",\"path\":\"/maps/vt\",\"request_count\":7,\"source\":\"10.20.30.227\"}`\n\n### MEDIUM — Script, archive, or executable transfer candidate\n\nHTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.\n\nRule: `script-or-executable-transfer@pcap-rules-v5`; confidence: 0.86; evidence: frame 13407 / TCP stream 137, frame 13467 / TCP stream 137.\n\nMetrics: `{\"content_type\":\"text/javascript\",\"declared_body_bytes\":57507,\"destination\":\"10.20.30.227\",\"response_count\":1,\"source\":\"172.217.9.170\",\"uri\":\"/maps-api-v3/api/js/38/11/controls.js\"}`\n\n### MEDIUM — Authentication-like token in cleartext HTTP URI\n\nAn HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.\n\nRule: `cleartext-tokenized-api@pcap-rules-v5`; confidence: 0.8; evidence: frame 13409 / TCP stream 146.\n\nMetrics: `{\"destination\":\"172.217.9.170\",\"host\":\"maps.googleapis.com\",\"path\":\"/maps/api/js/AuthenticationService.Authenticate\",\"request_count\":1,\"source\":\"10.20.30.227\"}`\n\n### MEDIUM — Authentication-like token in cleartext HTTP URI\n\nAn HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.\n\nRule: `cleartext-tokenized-api@pcap-rules-v5`; confidence: 0.8; evidence: frame 13477 / TCP stream 146.\n\nMetrics: `{\"destination\":\"172.217.9.170\",\"host\":\"maps.googleapis.com\",\"path\":\"/maps/api/js/QuotaService.RecordEvent\",\"request_count\":1,\"source\":\"10.20.30.227\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 137 / TCP stream 9, frame 139 / TCP stream 9, frame 141 / TCP stream 9, frame 152 / TCP stream 9, frame 154 / TCP stream 9.\n\nMetrics: `{\"destination\":\"10.20.30.227\",\"event_count\":38,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.20.30.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 61 / TCP stream 4, frame 121 / TCP stream 4, frame 130 / TCP stream 4, frame 136 / TCP stream 4, frame 171 / TCP stream 4.\n\nMetrics: `{\"destination\":\"10.20.30.227\",\"event_count\":67,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"10.20.30.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 807 / TCP stream 40, frame 809 / TCP stream 40, frame 811 / TCP stream 40, frame 813 / TCP stream 40, frame 815 / TCP stream 40.\n\nMetrics: `{\"destination\":\"10.20.30.227\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.20.30.2\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 135 / TCP stream 9, frame 138 / TCP stream 9, frame 140 / TCP stream 9, frame 151 / TCP stream 9, frame 153 / TCP stream 9.\n\nMetrics: `{\"destination\":\"10.20.30.2\",\"event_count\":38,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"10.20.30.227\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 59 / TCP stream 4, frame 117 / TCP stream 4, frame 129 / TCP stream 4, frame 133 / TCP stream 4, frame 168 / TCP stream 4.\n\nMetrics: `{\"destination\":\"10.20.30.2\",\"event_count\":83,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.20.30.227\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 806 / TCP stream 40, frame 808 / TCP stream 40, frame 810 / TCP stream 40, frame 812 / TCP stream 40, frame 814 / TCP stream 40.\n\nMetrics: `{\"destination\":\"10.20.30.2\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"10.20.30.227\"}`\n\n## ATT&CK candidates\n\n- T1105 Ingress Tool Transfer (command-and-control), confidence=0.8, status=suggested; basis=versioned-deterministic-rule.\n\n## Identities\n\n- account: `alejandrina.hogue`; client IPs: 10.20.30.227; frames: 702, 710, 712, 724, 744\n- account: `desktop-4c02emg$`; client IPs: 10.20.30.227; frames: 18, 46, 48, 66, 78\n- domain: `SOL-LIGHTNET`; client IPs: 10.20.30.227; frames: 787\n- full-name: `Alejandrina Hogue`; client IPs: 10.20.30.227; frames: 821\n- hostname: `DESKTOP-4C02EMG`; client IPs: 10.20.30.227; frames: 1, 278, 280, 482, 486\n- hostname: `DESKTOP-Y6CNQTE`; client IPs: 10.20.30.227; frames: 787\n- netbios-group: `SOL-LIGHTNET`; client IPs: unbound subject; frames: 2, 279, 487, 609, 612\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `adservice.google.com`; roles: dns-query, tls-sni\n- domain: `api.ipify.org`; roles: dns-query, http-host\n- domain: `apis.google.com`; roles: dns-query, tls-sni\n- domain: `assets.squarespace.com`; roles: dns-query, http-host\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `desktop-4c02emg.sol-lightnet.com`; roles: dns-query\n- domain: `dmd.metaservices.microsoft.com`; roles: dns-query, http-host\n- domain: `edge.microsoft.com`; roles: dns-query, tls-sni\n- domain: `ext-cust.squarespace.com`; roles: dns-cname\n- domain: `fonts.googleapis.com`; roles: dns-query, http-host\n- domain: `fonts.gstatic.com`; roles: dns-query, http-host, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `gengrasjeepram.com`; roles: dns-query, http-host\n- domain: `go.microsoft.com`; roles: dns-query, http-host\n- domain: `google.com`; roles: dns-query, http-host\n- domain: `googleads.g.doubleclick.net`; roles: dns-query, tls-sni\n- domain: `googlehosted.l.googleusercontent.com`; roles: dns-cname\n- domain: `gstaticadssl.l.google.com`; roles: dns-cname\n- domain: `images.squarespace-cdn.com`; roles: dns-query, tls-sni\n- domain: `khm0.googleapis.com`; roles: dns-query, http-host\n- domain: `khm1.googleapis.com`; roles: dns-query, http-host\n- domain: `l-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `lh4.googleusercontent.com`; roles: dns-query\n- domain: `lh5.googleusercontent.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `maps.google.com`; roles: dns-query\n- domain: `maps.googleapis.com`; roles: dns-query, http-host\n- domain: `maps.gstatic.com`; roles: dns-query, http-host\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `novvslyn.localdomain`; roles: dns-query\n- domain: `novvslyn.sol-lightnet.com`; roles: dns-query\n- domain: `ogs.google.com`; roles: dns-query, tls-sni\n- domain: `p.typekit.net`; roles: dns-query, tls-sni\n- domain: `pagead46.l.doubleclick.net`; roles: dns-cname\n- domain: `play.google.com`; roles: dns-query, tls-sni\n- domain: `plus.l.google.com`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `prod.squarespace.map.fastly.net`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `s-0001.s-msedge.net`; roles: dns-cname\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `self.events.data.onecollector.akadns.net`; roles: dns-cname\n- domain: `sol-lightnet-dc.sol-lightnet.com`; roles: dns-query\n- domain: `sol-lightnet.com`; roles: dns-query\n- domain: `squarespace.map.fastly.net`; roles: dns-cname\n- domain: `srjnzgvklqxna.localdomain`; roles: dns-query\n- domain: `srjnzgvklqxna.sol-lightnet.com`; roles: dns-query\n- domain: `ssl.gstatic.com`; roles: dns-query, tls-sni\n- domain: `star-mini.c10r.facebook.com`; roles: dns-cname\n- domain: `static1.squarespace.com`; roles: dns-query, http-host, tls-sni\n- domain: `t-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `twereptale.com`; roles: dns-query, http-host\n- domain: `use.typekit.net`; roles: dns-query, http-host, tls-sni\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.sol-lightnet.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- domain: `www.facebook.com`; roles: dns-query\n- domain: `www.google.com`; roles: dns-query, http-host, tls-sni\n- domain: `www.gstatic.com`; roles: dns-query, tls-sni\n- domain: `www.instagram.com`; roles: dns-query\n- domain: `www.tippingpointhampstead.com`; roles: dns-query, http-host\n- domain: `www3.l.google.com`; roles: dns-cname\n- domain: `xolightfinance.com`; roles: dns-query, http-host\n- domain: `z-p42-instagram.c10r.facebook.com`; roles: dns-cname\n- domain: `zpckjikzgjvck.localdomain`; roles: dns-query\n- domain: `zpckjikzgjvck.sol-lightnet.com`; roles: dns-query\n- ipv4: `10.20.30.1`; roles: network-endpoint\n- ipv4: `10.20.30.2`; roles: dns-answer, network-endpoint\n- ipv4: `10.20.30.227`; roles: dns-answer, network-endpoint\n- ipv4: `10.20.30.255`; roles: network-endpoint\n- ipv4: `104.81.85.107`; roles: dns-answer, network-endpoint\n- ipv4: `104.97.213.249`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.246.10`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.246.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.128`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.42.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.6.158`; roles: dns-answer, network-endpoint\n- ipv4: `148.66.137.40`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.0.238`; roles: dns-answer, network-endpoint\n- ipv4: `151.101.128.238`; roles: dns-answer\n- ipv4: `151.101.192.238`; roles: dns-answer\n- ipv4: `151.101.64.238`; roles: dns-answer\n- ipv4: `172.217.1.238`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.12.46`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.14.163`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.14.170`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.227`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.2.238`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.9.1`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.9.170`; roles: dns-answer, network-endpoint\n- ipv4: `172.217.9.3`; roles: dns-answer, network-endpoint\n- ipv4: `174.129.223.190`; roles: dns-answer\n- ipv4: `184.73.165.106`; roles: dns-answer, network-endpoint\n- ipv4: `184.73.201.169`; roles: dns-answer\n- ipv4: `198.185.159.144`; roles: dns-answer, network-endpoint\n- ipv4: `198.185.159.145`; roles: dns-answer\n- ipv4: `198.49.23.144`; roles: dns-answer\n- ipv4: `198.49.23.145`; roles: dns-answer\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.193.130`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.193.132`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.131`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.46`; roles: dns-answer, network-endpoint\n- ipv4: `216.58.194.78`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.21.50.37`; roles: dns-answer\n- ipv4: `23.21.59.179`; roles: dns-answer\n- ipv4: `23.51.186.146`; roles: dns-answer, network-endpoint\n- ipv4: `239.255.255.250`; roles: http-host, network-endpoint\n- ipv4: `31.13.93.174`; roles: dns-answer\n- ipv4: `31.13.93.35`; roles: dns-answer\n- ipv4: `40.126.0.66`; roles: dns-answer\n- ipv4: `40.126.0.67`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.0.68`; roles: dns-answer\n- ipv4: `40.126.0.69`; roles: dns-answer\n- ipv4: `40.126.0.70`; roles: dns-answer\n- ipv4: `40.126.0.72`; roles: dns-answer\n- ipv4: `40.126.0.73`; roles: dns-answer\n- ipv4: `40.126.0.74`; roles: dns-answer\n- ipv4: `40.67.249.61`; roles: dns-answer, network-endpoint\n- ipv4: `49.51.133.162`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.76.30`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.132.22`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.75.79`; roles: dns-answer, network-endpoint\n- ipv4: `52.242.211.89`; roles: dns-answer, network-endpoint\n- ipv4: `54.235.203.7`; roles: dns-answer\n- ipv4: `54.235.220.229`; roles: dns-answer\n- ipv4: `54.243.147.226`; roles: dns-answer\n- ipv4: `81.177.6.156`; roles: dns-answer, network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `66918128f1b9b03303d77c6f2eefd128`; roles: tls-client-fingerprint\n- ja3: `9e10692f1b7f78228b2d4e424db3a98c`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828`; roles: exported-object\n- sha256: `02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77`; roles: exported-object\n- sha256: `05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3`; roles: exported-object\n- sha256: `064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df`; roles: exported-object\n- sha256: `07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1`; roles: exported-object\n- sha256: `0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942`; roles: exported-object\n- sha256: `10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b`; roles: exported-object\n- sha256: `126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e`; roles: exported-object\n- sha256: `1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015`; roles: exported-object\n- sha256: `2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de`; roles: exported-object\n- sha256: `238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88`; roles: exported-object\n- sha256: `277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149`; roles: exported-object\n- sha256: `29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d`; roles: exported-object\n- sha256: `2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b`; roles: exported-object\n- sha256: `39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5`; roles: exported-object\n- sha256: `3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75`; roles: exported-object\n- sha256: `3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50`; roles: exported-object\n- sha256: `3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795`; roles: exported-object\n- sha256: `431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b`; roles: exported-object\n- sha256: `48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3`; roles: exported-object\n- sha256: `48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f`; roles: exported-object\n- sha256: `4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b`; roles: exported-object\n- sha256: `53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d`; roles: exported-object\n- sha256: `55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9`; roles: exported-object\n- sha256: `58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e`; roles: exported-object\n- sha256: `5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619`; roles: exported-object\n- sha256: `5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3`; roles: exported-object\n- sha256: `6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09`; roles: exported-object\n- sha256: `6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d`; roles: exported-object\n- sha256: `6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c`; roles: exported-object\n- sha256: `6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398`; roles: exported-object\n- sha256: `6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f`; roles: exported-object\n- sha256: `731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d`; roles: exported-object\n- sha256: `7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7`; roles: exported-object\n- sha256: `7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55`; roles: exported-object\n- sha256: `74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16`; roles: exported-object\n- sha256: `79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94`; roles: exported-object\n- sha256: `801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7`; roles: exported-object\n- sha256: `866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72`; roles: exported-object\n- sha256: `8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36`; roles: exported-object\n- sha256: `8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20`; roles: exported-object\n- sha256: `909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e`; roles: exported-object\n- sha256: `93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6`; roles: exported-object\n- sha256: `97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6`; roles: exported-object\n- sha256: `995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda`; roles: exported-object\n- sha256: `999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed`; roles: exported-object\n- sha256: `9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37`; roles: exported-object\n- sha256: `a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa`; roles: exported-object\n- sha256: `a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30`; roles: exported-object\n- sha256: `a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce`; roles: exported-object\n- sha256: `aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd`; roles: exported-object\n- sha256: `aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0`; roles: exported-object\n- sha256: `b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e`; roles: exported-object\n- sha256: `b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00`; roles: exported-object\n- sha256: `c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd`; roles: exported-object\n- sha256: `c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443`; roles: exported-object\n- sha256: `c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1`; roles: exported-object\n- sha256: `c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1`; roles: exported-object\n- sha256: `d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e`; roles: exported-object\n- sha256: `e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5`; roles: exported-object\n- sha256: `e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f`; roles: exported-object\n- sha256: `ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf`; roles: exported-object\n- sha256: `ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db`; roles: exported-object\n- sha256: `f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4`; roles: exported-object\n- sha256: `f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200`; roles: exported-object\n- sha256: `f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12`; roles: exported-object\n- sha256: `f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627`; roles: exported-object\n- sha256: `fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d`; roles: exported-object\n- sha256: `fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774`; roles: exported-object\n- sha256: `fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588`; roles: exported-object\n- url: `http://239.255.255.250:1900*`; roles: http-request\n- url: `http://api.ipify.org/`; roles: http-request\n- url: `http://assets.squarespace.com/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js`; roles: http-request\n- url: `http://assets.squarespace.com/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js`; roles: http-request\n- url: `http://assets.squarespace.com/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js`; roles: http-request\n- url: `http://assets.squarespace.com/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css`; roles: http-request\n- url: `http://dmd.metaservices.microsoft.com/metadata.svc`; roles: http-request\n- url: `http://fonts.googleapis.com/css?family=Lato:100,400,700i,700,400i`; roles: http-request\n- url: `http://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Google+Sans`; roles: http-request\n- url: `http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2`; roles: http-request\n- url: `http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2`; roles: http-request\n- url: `http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2`; roles: http-request\n- url: `http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2`; roles: http-request\n- url: `http://gengrasjeepram.com/sv.exe`; roles: http-request\n- url: `http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409`; roles: http-request\n- url: `http://google.com/`; roles: http-request\n- url: `http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3317&z=13`; roles: http-request\n- url: `http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3318&z=13`; roles: http-request\n- url: `http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3317&z=13`; roles: http-request\n- url: `http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3318&z=13`; roles: http-request\n- url: `http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3317&z=13`; roles: http-request\n- url: `http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3318&z=13`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/common.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/controls.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/map.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/marker.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/onion.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/stats.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps-api-v3/api/js/38/11/util.js`; roles: http-request\n- url: `http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US`; roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] roles: http-request\n- url: `http://maps.gstatic.com/mapfiles/api-3/images/google_white5.png`; roles: http-request\n- url: `http://maps.gstatic.com/mapfiles/api-3/images/spotlight-poi2.png`; roles: http-request\n- url: `http://maps.gstatic.com/mapfiles/openhand_8_8.cur`; roles: http-request\n- url: `http://maps.gstatic.com/mapfiles/transparent.png`; roles: http-request\n- url: `http://static1.squarespace.com/static/531a38d5e4b06ab55728bbcd/t/535732bde4b0ff45f1eff4ee/1575563567328/?format=1500w`; roles: http-request\n- url: `http://static1.squarespace.com/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false`; roles: http-request\n- url: `http://twereptale.com/4/forum.php`; roles: http-request\n- url: `http://twereptale.com/d2/about.php`; roles: http-request\n- url: `http://twereptale.com/mlu/forum.php`; roles: http-request\n- url: `http://use.typekit.net/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js`; roles: http-request\n- url: `http://www.google.com/`; roles: http-request\n- url: `http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/api/1/performance/records`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/api/1/performance/settings`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/api/census/form-render`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/api/census/RecordHit`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/api/events/RecordEvent`; roles: http-request\n- url: `http://www.tippingpointhampstead.com/contact`; roles: http-request\n- url: `http://xolightfinance.com/bhola/images/1`; roles: http-request\n- url: `http://xolightfinance.com/bhola/images/2`; roles: http-request\n- user_agent: `Microsoft Edge/79.0.309.71 Windows`; roles: http-client\n- user_agent: `MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71`; roles: http-client\n- user_agent: `Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko`; roles: http-client\n- exported object `common-be17db26807bce4867107-min.en-US.js`; SHA-256 `2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b`; size 1659717 bytes\n SHA-1: `be17db26807bce486710733931ff6cf5bebde8eb`; MD5: `117a5b52b949a037f43aed09cd46eeba`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9991,\"response_frame\":10744,\"server_ip\":\"104.97.213.249\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://assets.squarespace.com/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":43302}],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `util.js`; SHA-256 `f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12`; size 146174 bytes\n SHA-1: `41df59c1cae8ead1cbbbb3cef1af783136b69108`; MD5: `fdefb508fc621937753e1c2dc8f4b495`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13052,\"response_frame\":13163,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":135,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/util.js\"}]`.\n Static content: `{\"content_kind\":\"script-like-text\",\"features\":[{\"excerpt\":\"eval(\",\"feature\":\"dynamic-evaluation\",\"offset\":33879}],\"inspected_bytes\":146174,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":146174,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `sv.exe`; SHA-256 `995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda`; size 81920 bytes\n SHA-1: `8ffdeebf7b41fe65b2d92eed18ddd6c39eeea2d8`; MD5: `e409d5c467ca3ff5c7b4e4963629ee18`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1169,\"response_frame\":1235,\"server_ip\":\"49.51.133.162\",\"status_code\":\"200\",\"tcp_stream\":55,\"url\":\"http://gengrasjeepram.com/sv.exe\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":81920,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":81920,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `commerce-181ca5d368ee93562112c-min.en-US.js`; SHA-256 `ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db`; size 1459260 bytes\n SHA-1: `181ca5d368ee93562112cc1e15ee09e46bc3e428`; MD5: `8ac56ebfedaa877fcc4518e68956d345`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9993,\"response_frame\":10645,\"server_ip\":\"104.97.213.249\",\"status_code\":\"200\",\"tcp_stream\":112,\"url\":\"http://assets.squarespace.com/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `site.css%3f&filterFeatures=false`; SHA-256 `6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f`; size 542610 bytes\n SHA-1: `98b83102f9d62e74324701711b204f1439052548`; MD5: `5c9c0b0be25a2dfeac4417883d82bb98`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10010,\"response_frame\":10246,\"server_ip\":\"151.101.0.238\",\"status_code\":\"200\",\"tcp_stream\":114,\"url\":\"http://static1.squarespace.com/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `controls.js`; SHA-256 `29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d`; size 213467 bytes\n SHA-1: `58e86782a06760d0e7e9c427ddedd7600ef285ca`; MD5: `141ad3be0dc23c12a76a821d919dabe8`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13407,\"response_frame\":13467,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":137,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/controls.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":213467,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `js%3fv=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US`; SHA-256 `4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b`; size 117672 bytes\n SHA-1: `5dfa727104dfa02d8d3a339bc7e2ad4421a20939`; MD5: `07d9cd2bbe3111a49f2e07ba65bcf92d`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12989,\"response_frame\":13035,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":134,\"url\":\"http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":117672,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `common.js`; SHA-256 `3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50`; size 77975 bytes\n SHA-1: `8f4088ba251a07c1d4eec4974e37baaa8ddd925f`; MD5: `2f34f6f334c8277edfe3361843c9cb7e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13042,\"response_frame\":13084,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":134,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/common.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":77975,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(3)`; SHA-256 `79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94`; size 54163 bytes\n SHA-1: `990a4fcc4489b69349e7f1115b546d8134ff92f9`; MD5: `d6f26f9077ec101b427f26337f155203`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9949,\"response_frame\":9963,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.tippingpointhampstead.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":54163,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `2`; SHA-256 `999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed`; size 47394 bytes\n SHA-1: `ab9fd524dd81b9f35b6817f2c019c128fa85170b`; MD5: `26096cbfb43f2f1c1ceb1726b2168f54`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3430,\"response_frame\":3487,\"server_ip\":\"148.66.137.40\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://xolightfinance.com/bhola/images/2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":47394,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `performance-6c529d24ffaa4730ab163-min.en-US.js`; SHA-256 `55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9`; size 47293 bytes\n SHA-1: `6c529d24ffaa4730ab163e2daa8b41406f29a124`; MD5: `c0469c4b0aecb6a9bf9eceadbe6a3635`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9995,\"response_frame\":10068,\"server_ip\":\"104.97.213.249\",\"status_code\":\"200\",\"tcp_stream\":110,\"url\":\"http://assets.squarespace.com/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":47293,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `1`; SHA-256 `f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627`; size 46334 bytes\n SHA-1: `776d1ccbe6c0dcd95155f6899e59270fdb5feec4`; MD5: `673a98c749e09db2d4ee708b854a2ea5`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1260,\"response_frame\":1306,\"server_ip\":\"148.66.137.40\",\"status_code\":\"200\",\"tcp_stream\":58,\"url\":\"http://xolightfinance.com/bhola/images/1\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":46334,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `map.js`; SHA-256 `ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf`; size 42435 bytes\n SHA-1: `f62af1356d353430628c52b1a8ca163ef44da592`; MD5: `2c680fad043ffb2f48f8597985f9d6af`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13054,\"response_frame\":13121,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":137,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/map.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":42435,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `contact`; SHA-256 `5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3`; size 41620 bytes\n SHA-1: `94144ff748aebbc0ef9b910f71f3802a38096231`; MD5: `497b73229d5a8cc623535edd5b0c254e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12904,\"response_frame\":12942,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":128,\"url\":\"http://www.tippingpointhampstead.com/contact\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":41620,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `marker.js`; SHA-256 `c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd`; size 31427 bytes\n SHA-1: `41c7276656cfc056a746621a59f808e882bdcc78`; MD5: `236382984a4a7d627213318e6203c85e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13056,\"response_frame\":13093,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":136,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/marker.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":31427,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `ViewportInfoService.GetViewportInfo%3f1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted] SHA-256 `0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828`; size 27756 bytes\n SHA-1: `9efe291c8232dabeb7a02262fb4e9af53a6a5857`; MD5: `b2c902627861d4dcd785c764fd067f4e`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13187,\"response_frame\":13228,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":135,\"url\":\"http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":27756,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `onion.js`; SHA-256 `c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1`; size 24657 bytes\n SHA-1: `822dceb4ff5087c25933af3c9e2f6892468fb20d`; MD5: `7c0dd8dc02254ee3692d825ae0a214b6`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13167,\"response_frame\":13178,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":135,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/onion.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":24657,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kh%3fv=863&hl=en&x=2133&y=3317&z=13`; SHA-256 `5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619`; size 23566 bytes\n SHA-1: `03f6b850aeebdb00634ba58adcebb9b987d40a5e`; MD5: `a8b469f5e1cdb418c8acdfa0f434eb6a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13219,\"response_frame\":13336,\"server_ip\":\"172.217.12.46\",\"status_code\":\"200\",\"tcp_stream\":142,\"url\":\"http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3317&z=13\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23566,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `S6uyw4BMUTPHjx4wXg.woff2`; SHA-256 `c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1`; size 23484 bytes\n SHA-1: `c82e22dde9716c40ba20e6c7ed03a1b66556de15`; MD5: `b4d2c4c39853ee244272c04999b230ba`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11080,\"response_frame\":11148,\"server_ip\":\"172.217.14.163\",\"status_code\":\"200\",\"tcp_stream\":117,\"url\":\"http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":23484,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `S6u9w4BMUTPHh6UVSwiPGQ.woff2`; SHA-256 `8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20`; size 22992 bytes\n SHA-1: `8a49976f2470ba2a1db6144245355d3b889312e4`; MD5: `1efbd38aa76ddae2580fedf378276333`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11111,\"response_frame\":11212,\"server_ip\":\"172.217.14.163\",\"status_code\":\"200\",\"tcp_stream\":120,\"url\":\"http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":22992,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kh%3fv=863&hl=en&x=2135&y=3317&z=13`; SHA-256 `07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1`; size 22721 bytes\n SHA-1: `9a21943e4c01265613f36b620fd92ad5eeeaf2ba`; MD5: `9f7b7c03dea7ed515990f4db044f3353`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13221,\"response_frame\":13328,\"server_ip\":\"172.217.12.46\",\"status_code\":\"200\",\"tcp_stream\":143,\"url\":\"http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3317&z=13\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":22721,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kh%3fv=863&hl=en&x=2134&y=3317&z=13`; SHA-256 `97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6`; size 22229 bytes\n SHA-1: `5092d659fdad8c18acc93d9a782d138ffb3f3a1c`; MD5: `73ee5c0dcf5f05ffb4756b17dc00f90d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13217,\"response_frame\":13335,\"server_ip\":\"172.217.2.238\",\"status_code\":\"200\",\"tcp_stream\":140,\"url\":\"http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3317&z=13\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":22229,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `S6u8w4BMUTPHh30AXC-q.woff2`; SHA-256 `6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398`; size 21580 bytes\n SHA-1: `e3e2ec190dfb76e15fbe4d3ca07da6af0679a589`; MD5: `9ca14b8703044ec44627982d6d0e1e44`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11122,\"response_frame\":11220,\"server_ip\":\"172.217.14.163\",\"status_code\":\"200\",\"tcp_stream\":121,\"url\":\"http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":21580,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kh%3fv=863&hl=en&x=2133&y=3318&z=13`; SHA-256 `3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795`; size 21039 bytes\n SHA-1: `538f1f2335006e1fb8711a01b5c11e504741f026`; MD5: `48a90870ec9f6ac2f9d8825b370d6732`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13215,\"response_frame\":13334,\"server_ip\":\"172.217.12.46\",\"status_code\":\"200\",\"tcp_stream\":141,\"url\":\"http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3318&z=13\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":21039,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNl.js`; SHA-256 `126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e`; size 19548 bytes\n SHA-1: `c810442ae1abaea97bebcd4fd6a8569db2954896`; MD5: `56c11c00f539303f60e0a6ce3f606ec8`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9976,\"response_frame\":10081,\"server_ip\":\"104.81.85.107\",\"status_code\":\"200\",\"tcp_stream\":108,\"url\":\"http://use.typekit.net/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19548,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kh%3fv=863&hl=en&x=2134&y=3318&z=13`; SHA-256 `10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b`; size 19250 bytes\n SHA-1: `41a263b22a5bbf0d2037472941e655ba72491f04`; MD5: `a428ec6bb139448787bc2c86c4b5b8a8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13203,\"response_frame\":13299,\"server_ip\":\"172.217.2.238\",\"status_code\":\"200\",\"tcp_stream\":139,\"url\":\"http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3318&z=13\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":19250,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `kh%3fv=863&hl=en&x=2135&y=3318&z=13`; SHA-256 `02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77`; size 16902 bytes\n SHA-1: `c102f804b08dc80a68fcd701de20583ca4e550ea`; MD5: `40b2fd83c8feea5d2b5bdd8073124db3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13223,\"response_frame\":13357,\"server_ip\":\"172.217.12.46\",\"status_code\":\"200\",\"tcp_stream\":144,\"url\":\"http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3318&z=13\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":16902,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `KFOmCnqEu92Fr1Mu4mxK.woff2`; SHA-256 `48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3`; size 15736 bytes\n SHA-1: `81c796737cbe44d4a719777f0aff14b73a3efb1e`; MD5: `479970ffb74f2117317f9d24d9e317fe`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13483,\"response_frame\":13501,\"server_ip\":\"172.217.14.163\",\"status_code\":\"200\",\"tcp_stream\":121,\"url\":\"http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":15736,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=Roboto%3a300,400,500,700%7cGoogle+Sans`; SHA-256 `277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149`; size 11036 bytes\n SHA-1: `c7705370535c687ba371a0c2c260cdfff6622f7d`; MD5: `46aeae7ba2e0a5a878ac0f9cd6f78686`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13471,\"response_frame\":13476,\"server_ip\":\"172.217.14.170\",\"status_code\":\"200\",\"tcp_stream\":113,\"url\":\"http://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Google+Sans\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":11036,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css`; SHA-256 `74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16`; size 9882 bytes\n SHA-1: `8b9f9d9e560afa50db555b4258a846aa7245d5c4`; MD5: `d5d1d165eb43a2fed99901e0e7b185a3`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9999,\"response_frame\":10037,\"server_ip\":\"104.97.213.249\",\"status_code\":\"200\",\"tcp_stream\":111,\"url\":\"http://assets.squarespace.com/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":9882,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `stats.js`; SHA-256 `58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e`; size 3862 bytes\n SHA-1: `ebaf55d1deff3b09306caa82a883758bf4e40ea7`; MD5: `94dff1faba9bea2f4d924a50b62edacc`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13169,\"response_frame\":13181,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":137,\"url\":\"http://maps.googleapis.com/maps-api-v3/api/js/38/11/stats.js\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3862,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `css%3ffamily=Lato%3a100,400,700i,700,400i`; SHA-256 `05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3`; size 3803 bytes\n SHA-1: `9734883c8cf2459068a410df38a32d64824c5902`; MD5: `3ca236f3899f59e6e007648fea9948fd`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":10016,\"response_frame\":10196,\"server_ip\":\"172.217.14.170\",\"status_code\":\"200\",\"tcp_stream\":113,\"url\":\"http://fonts.googleapis.com/css?family=Lato:100,400,700i,700,400i\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3803,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vt%3fpb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&`; SHA-256 `3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75`; size 3227 bytes\n SHA-1: `f3ba3584c4e013b3542ec75276300db78bc20f23`; MD5: `faeda88ecb285d867d6457c3778cad47`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13364,\"response_frame\":13390,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":136,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":3227,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `settings`; SHA-256 `c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443`; size 2960 bytes\n SHA-1: `9dbcc12141ebdf098a30df39bc7cfafbe5be018c`; MD5: `92ac58616a5c101bc36f14b2fa5ade8c`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11073,\"response_frame\":11147,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":107,\"url\":\"http://www.tippingpointhampstead.com/api/1/performance/settings\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2960,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `settings(1)`; SHA-256 `1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015`; size 2959 bytes\n SHA-1: `aebe06e504a54a7c29ac65c01f4be9cb0ec18447`; MD5: `94ca7571e726c88c0bf98a9a000cbd6b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12979,\"response_frame\":13011,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":133,\"url\":\"http://www.tippingpointhampstead.com/api/1/performance/settings\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2959,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vt%3fpb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&`; SHA-256 `6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09`; size 2842 bytes\n SHA-1: `853e00de12e678a55c85f8c33f371ce259779066`; MD5: `f4cbc7131de17d33379bc12f54c4a6e9`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13366,\"response_frame\":13395,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":134,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2842,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vt%3fpb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&`; SHA-256 `7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55`; size 2818 bytes\n SHA-1: `1a4cbccac5fbc3ec33a382f367b42a55d9acdc64`; MD5: `b6b85d812586384c6d7e37ea1973256d`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13377,\"response_frame\":13400,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":146,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2818,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `records`; SHA-256 `e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f`; size 2385 bytes\n SHA-1: `36b3b22d436084515e791a3bc3da016a43c1fdb3`; MD5: `63c3fec43ca067c2ca4d3cbe2c4ef8d4`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `%3fLinkID=252669&clcid=0x409(1)`; SHA-256 `431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b`; size 2048 bytes\n SHA-1: `58df7280e0296813c71091c6a59de1d05f9974c3`; MD5: `f60c34ea8550c8f2f78c0d09c46f95b7`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `vt%3fpb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&`; SHA-256 `a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa`; size 1836 bytes\n SHA-1: `100452357f7a102abcdfc4106976fd828949d90e`; MD5: `bb5e186a80a30fd0bae72a0da4345502`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13362,\"response_frame\":13383,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":137,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1836,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `metadata(3).svc`; SHA-256 `9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37`; size 1734 bytes\n SHA-1: `a77ae6d345257c7367c5c1822e1d38e540988e8e`; MD5: `22a664c1a95eb79364651c6106190cfe`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":531,\"response_frame\":606,\"server_ip\":\"40.67.249.61\",\"status_code\":\"200\",\"tcp_stream\":24,\"url\":\"http://dmd.metaservices.microsoft.com/metadata.svc\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1734,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `metadata(1).svc`; SHA-256 `53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d`; size 1728 bytes\n SHA-1: `296c7d8c4b359bbfa662eb06580f3c0b34421c46`; MD5: `0d3164761ca1d073c0a4ff5f4386648a`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":506,\"response_frame\":509,\"server_ip\":\"40.67.249.61\",\"status_code\":\"200\",\"tcp_stream\":24,\"url\":\"http://dmd.metaservices.microsoft.com/metadata.svc\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1728,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `google_white5.png`; SHA-256 `0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942`; size 1642 bytes\n SHA-1: `ca1f545dbe9a208f3b1537bdb3ef1245f3215254`; MD5: `3cfd8e5f5f514fab43ec377c298f060e`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13474,\"response_frame\":13481,\"server_ip\":\"172.217.2.227\",\"status_code\":\"200\",\"tcp_stream\":145,\"url\":\"http://maps.gstatic.com/mapfiles/api-3/images/google_white5.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1642,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vt%3fpb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i4982125._gj3smp&key=[redacted-captured-api-key]&token=[redacted] SHA-256 `238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88`; size 1245 bytes\n SHA-1: `20200bebc4cd6cbd6a73743472b21c16e7dad903`; MD5: `085e783aad409211aff58ca693cbd2ce`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13385,\"response_frame\":13403,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":137,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1245,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%3fLinkID=252669&clcid=0x409`; SHA-256 `801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7`; size 1242 bytes\n SHA-1: `10eda8bc1feb2e67b563749605af21718cc5d914`; MD5: `96e99b36f4d9c88f67f7f7bda63d18fc`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `records(1)`; SHA-256 `a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce`; size 1205 bytes\n SHA-1: `da4e2d247011d7709a542a11200c77bb97aff543`; MD5: `39bd087a11544b4eae680358d488142d`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `RecordHit`; SHA-256 `731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d`; size 1054 bytes\n SHA-1: `6289ebb0444edff42a941e349cc8ac10d3e18149`; MD5: `654d28ad233085000fdb641367ca2677`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `url%3fsa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L`; SHA-256 `d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e`; size 899 bytes\n SHA-1: `4b2d1d88b08be3fe84aef68fac5c142b90007e45`; MD5: `d0ff997fcee9e1eea1afda36e9404ccd`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":9913,\"response_frame\":9927,\"server_ip\":\"216.58.193.132\",\"status_code\":\"200\",\"tcp_stream\":91,\"url\":\"http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":899,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `RecordHit(2)`; SHA-256 `39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5`; size 876 bytes\n SHA-1: `6b6072f373b072b8f4fffb17813f45e4390f6028`; MD5: `7b415b1a00b8f322eb5971b6030c242f`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `spotlight-poi2.png`; SHA-256 `aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0`; size 817 bytes\n SHA-1: `b16c75de6ea22d9490c809be5fe929d4c7206468`; MD5: `db9fcccb5a88f0c8c46b965fdc4b6f6c`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13353,\"response_frame\":13372,\"server_ip\":\"172.217.2.227\",\"status_code\":\"200\",\"tcp_stream\":145,\"url\":\"http://maps.gstatic.com/mapfiles/api-3/images/spotlight-poi2.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":817,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vt%3fpb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&`; SHA-256 `a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30`; size 618 bytes\n SHA-1: `302b4fd4eab8ed1600caba953822744a9a274979`; MD5: `0499a46518a01ddeefbf5a5ec3b94a14`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13379,\"response_frame\":13397,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":147,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":618,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(1).php`; SHA-256 `b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00`; size 436 bytes\n SHA-1: `80153d1598a1b9c94cd2b9617d9beb7e18ec93fb`; MD5: `23c12517a1687713b2182e52a411aaed`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1251,\"response_frame\":1253,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":57,\"url\":\"http://twereptale.com/4/forum.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":436,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `vt%3fpb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&`; SHA-256 `93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6`; size 364 bytes\n SHA-1: `6ad289122022ffeee9cec71f5f9d5e8a3e7ab3f3`; MD5: `f9e1edd96c64ae92252793a474e40d3f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13360,\"response_frame\":13387,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":135,\"url\":\"http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":364,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `openhand_8_8.cur`; SHA-256 `7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7`; size 326 bytes\n SHA-1: `0d0a08cf25a258511957f357b89d3908f3c5e6e3`; MD5: `feff9159f56cb2069041d660b484eb07`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13191,\"response_frame\":13225,\"server_ip\":\"172.217.2.227\",\"status_code\":\"200\",\"tcp_stream\":138,\"url\":\"http://maps.gstatic.com/mapfiles/openhand_8_8.cur\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":326,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `RecordEvent`; SHA-256 `48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f`; size 314 bytes\n SHA-1: `3370d2855535d2494fd22f21b1da190e13c83a39`; MD5: `5a014414b96edc2183523931a8826cc0`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `form-render`; SHA-256 `064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df`; size 247 bytes\n SHA-1: `f7a929b2bfdf9b0eb790f167e50ea69a862e0e87`; MD5: `10a37c7498a8eed2c6b8bbf9f3109f08`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `%2f(2)`; SHA-256 `f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200`; size 231 bytes\n SHA-1: `43c3c326039fde13b0473b08d729e6fcd7c643b3`; MD5: `68a006996ece55adef2db478ed631ea5`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8231,\"response_frame\":8233,\"server_ip\":\"216.58.193.132\",\"status_code\":\"302\",\"tcp_stream\":91,\"url\":\"http://www.google.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":231,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f(1)`; SHA-256 `2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de`; size 219 bytes\n SHA-1: `c79f5572f672361bc097676cb5da9d4aa956c8b9`; MD5: `d4b691cd9d99117b2ea34586d3e7eeb8`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8222,\"response_frame\":8224,\"server_ip\":\"216.58.194.46\",\"status_code\":\"301\",\"tcp_stream\":89,\"url\":\"http://google.com/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":219,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(3).php`; SHA-256 `aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd`; size 135 bytes\n SHA-1: `8ae3aa2ad18f857b3b19573dbf2e81a5caebdc9e`; MD5: `7a1b068c195fae4653d247f5d228f82f`; completeness: unknown; transfers: `[]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n- exported object `transparent.png`; SHA-256 `fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588`; size 68 bytes\n SHA-1: `a812c79b0d125e4946b33446eae0353f518627e2`; MD5: `8327a6037ae00a5be9f75e63ee1b9fbe`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13302,\"response_frame\":13359,\"server_ip\":\"172.217.2.227\",\"status_code\":\"200\",\"tcp_stream\":138,\"url\":\"http://maps.gstatic.com/mapfiles/transparent.png\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":68,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `QuotaService.RecordEvent%3f1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted] SHA-256 `b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e`; size 62 bytes\n SHA-1: `961f8c55b11a9a9f9276fe5c401cb0a56c40e763`; MD5: `652ab4ef2a3326ce45feeb1e2bee9d60`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13477,\"response_frame\":13503,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":146,\"url\":\"http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":62,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `AuthenticationService.Authenticate%3f1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted] SHA-256 `fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774`; size 62 bytes\n SHA-1: `39bf8430f0fc8cc6cbfd74b68cfa9e3e423798ae`; MD5: `2c86c7d21ca528c834ee4cf219f639fa`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":13409,\"response_frame\":13468,\"server_ip\":\"172.217.9.170\",\"status_code\":\"200\",\"tcp_stream\":146,\"url\":\"http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":62,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(2).php`; SHA-256 `fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d`; size 20 bytes\n SHA-1: `a7da437ddbf372d3399fcf5f214c218f99a9dfde`; MD5: `a71875fce43962cc81991aa859eebcb1`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1315,\"response_frame\":1317,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":59,\"url\":\"http://twereptale.com/mlu/forum.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":20,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `RecordEvent(1)`; SHA-256 `f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4`; size 17 bytes\n SHA-1: `484b3032619fa1acd135d114565b0a5166281c22`; MD5: `5b64e8b89092b2e3dfd448b10700627f`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11070,\"response_frame\":11473,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":106,\"url\":\"http://www.tippingpointhampstead.com/api/census/RecordHit\"},{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12960,\"response_frame\":12980,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":129,\"url\":\"http://www.tippingpointhampstead.com/api/events/RecordEvent\"},{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12962,\"response_frame\":12992,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":132,\"url\":\"http://www.tippingpointhampstead.com/api/census/form-render\"},{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12957,\"response_frame\":13037,\"server_ip\":\"198.185.159.144\",\"status_code\":\"200\",\"tcp_stream\":128,\"url\":\"http://www.tippingpointhampstead.com/api/census/RecordHit\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":17,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `%2f`; SHA-256 `e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5`; size 15 bytes\n SHA-1: `ffe91b2ad0239a338097917b4df63a460e71829a`; MD5: `b52cf3b831ed62037b323b862496dd51`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1242,\"response_frame\":1244,\"server_ip\":\"184.73.165.106\",\"status_code\":\"200\",\"tcp_stream\":56,\"url\":\"http://api.ipify.org/\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":15,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `about.php`; SHA-256 `6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c`; size 13 bytes\n SHA-1: `9dbf6887663b8a3cee2e2c80d80ed32d9f67e562`; MD5: `cfead1c7c639d2395cf39be2d9bffab5`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":3586,\"response_frame\":3589,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":63,\"url\":\"http://twereptale.com/d2/about.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":13,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(8).php`; SHA-256 `6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d`; size 12 bytes\n SHA-1: `030364f097f19f4abb8ff27162d8326ac5418753`; MD5: `334f2493d31a558d30ebda0259b396aa`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7916,\"response_frame\":7918,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":80,\"url\":\"http://twereptale.com/4/forum.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(6).php`; SHA-256 `866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72`; size 12 bytes\n SHA-1: `876cbd260187e68225bd7c41b8f1a470810b8790`; MD5: `caf53bc088dff3bfa04cf496ad23f9f0`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7823,\"response_frame\":7825,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":76,\"url\":\"http://twereptale.com/4/forum.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(10).php`; SHA-256 `8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36`; size 12 bytes\n SHA-1: `a3edf4caac4ea503e88de757cb5e5a5fa6772d56`; MD5: `25925f7fea5bf95a6a37a45346dacc0b`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":12855,\"response_frame\":12857,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":127,\"url\":\"http://twereptale.com/4/forum.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `forum(4).php`; SHA-256 `909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e`; size 12 bytes\n SHA-1: `0d3f38ebbd11bde884d38953e48623c1a08fc0a7`; MD5: `d3d241f1f7a282a3e7f8c9037d36d46d`; completeness: unknown; transfers: `[{\"client_ip\":\"10.20.30.227\",\"completeness\":\"unknown\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7711,\"response_frame\":7713,\"server_ip\":\"81.177.6.156\",\"status_code\":\"200\",\"tcp_stream\":70,\"url\":\"http://twereptale.com/4/forum.php\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":12,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- Volatile Cedar (G0123): 20% TTP overlap. This is an investigation lead, not attribution.\n- Winnti Group (G0044): 17% TTP overlap. This is an investigation lead, not attribution.\n- Ajax Security Team (G0130): 17% TTP overlap. This is an investigation lead, not attribution.\n- IndigoZebra (G0136): 14% TTP overlap. This is an investigation lead, not attribution.\n- Nomadic Octopus (G0133): 14% TTP overlap. This is an investigation lead, not attribution.\n- Metador (G1013): 11% TTP overlap. This is an investigation lead, not attribution.\n- Whitefly (G0107): 11% TTP overlap. This is an investigation lead, not attribution.\n- Elderwood (G0066): 11% TTP overlap. This is an investigation lead, not attribution.\n- Rancor (G0075): 11% TTP overlap. This is an investigation lead, not attribution.\n- Evilnum (G0120): 9% TTP overlap. This is an investigation lead, not attribution.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `b92e780dc39ce7723d6ec8f29efdc3bd1a63f07184fbffcc7b8723ab3277df7d`; recorded 2026-09-22T16:01:34.871807+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":279,\"observable_limit\":5000,\"observables_checked\":279,\"observables_total\":279,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Catalog T1105: https://attack.mitre.org/techniques/T1105; detection strategies: [{\"attack_id\":\"DET0060\",\"name\":\"Detect Ingress Tool Transfers via Behavioral Chain\",\"stix_id\":\"x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554\"}]\n- Prior analysis `d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 50 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 34 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 6 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 20 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 3 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 9 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 17 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 23 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 13 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":70,\"export_status\":\"completed\",\"exported_objects\":79,\"hashed_bytes\":4960097,\"hashed_objects\":79,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":70,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":70}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 24/24, identities 7/7, observables 279/279, artifacts 70/70. Full returned inventory is in the JSON result.\n- Warning: Conflicting TCP overlap: fallback extraction rejected this direction\n\n## Evidence-backed IOC assessment\n\n267 typed observations; 16 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `6806d40abf2b793023cd0ff23445a8988aad07b2d83979daa3c4a9076988c5db`.\n\n- domain `maps.googleapis.com` — suspicious; evidence: `[{\"finding_id\":\"finding-c3e36d091e5d2ec8be6957e1\",\"frame_number\":12989,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-24258cf33df9c63f3da9f31c\",\"frame_number\":13187,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13360,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13362,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13364,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13366,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13377,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13379,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13385,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-4ccbf4ba009b4882e4c367c4\",\"frame_number\":13409,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-96ad3dbaa154e41ef3d6b17f\",\"frame_number\":13477,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:36.866533+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:36.673212+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:36.669102+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- domain `twereptale.com` — suspicious; evidence: `[{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":1251,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7711,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7823,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7916,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":12855,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.048441+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:36.874138+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:36.870741+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- ipv4 `172.217.9.170` — suspicious; evidence: `[{\"finding_id\":\"finding-c3e36d091e5d2ec8be6957e1\",\"frame_number\":12989,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-24258cf33df9c63f3da9f31c\",\"frame_number\":13187,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13360,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13362,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13364,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13366,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13377,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13379,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13385,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-4ccbf4ba009b4882e4c367c4\",\"frame_number\":13409,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"},{\"finding_id\":\"finding-96ad3dbaa154e41ef3d6b17f\",\"frame_number\":13477,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.353678+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.057543+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.053083+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- ipv4 `81.177.6.156` — suspicious; evidence: `[{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":1251,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7711,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7823,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7916,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":12855,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"}]`; provider signals: `[{\"actors\":[],\"basis\":\"No verdict: not-applicable\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.660586+00:00\",\"relationship_context\":[],\"source\":\"malwarebazaar\",\"status\":\"not-applicable\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: not_found\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.362379+00:00\",\"relationship_context\":[],\"source\":\"threatfox\",\"status\":\"not_found\",\"technique_ids\":[],\"verdict\":\"unknown\"},{\"actors\":[],\"basis\":\"No verdict: deferred-rate-limit\",\"cache_hit\":false,\"context_status\":\"provider-assertion-not-capture-behavior-or-attribution\",\"cooldown_scope\":\"shared-redis\",\"error_category\":\"rate_limited\",\"evidence\":{},\"queried_at\":\"2026-09-22T17:45:37.357743+00:00\",\"relationship_context\":[],\"retry_at\":\"2026-09-22T17:49:29.781117+00:00\",\"source\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"technique_ids\":[],\"verdict\":\"unknown\"}]`\n- url `http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-4ccbf4ba009b4882e4c367c4\",\"frame_number\":13409,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-96ad3dbaa154e41ef3d6b17f\",\"frame_number\":13477,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-24258cf33df9c63f3da9f31c\",\"frame_number\":13187,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US` — suspicious; evidence: `[{\"finding_id\":\"finding-c3e36d091e5d2ec8be6957e1\",\"frame_number\":12989,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13385,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13364,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13362,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13366,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13360,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13377,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted] — suspicious; evidence: `[{\"finding_id\":\"finding-5d9f1d3604e2f2431a0af1c1\",\"frame_number\":13379,\"kind\":\"behavior\",\"rule_id\":\"cleartext-tokenized-api\"}]`; provider signals: `[]`\n- url `http://twereptale.com/4/forum.php` — suspicious; evidence: `[{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":1251,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7711,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7823,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":7916,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"},{\"finding_id\":\"finding-4374d41956c0deaa7b0a7227\",\"frame_number\":12855,\"kind\":\"behavior\",\"rule_id\":\"repeated-http-posts\"}]`; provider signals: `[]`\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `682ddd00034d69c3a1b1a820dbe79a898659b79ed28f069a3dbc2beec4625174`; updated 2026-09-22T17:45:50.416576+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-72644bc6f0fc8e638d1d05a6\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-72644bc6f0fc8e638d1d05a6\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":1,\"retained_targets\":71,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 3138, "stream": 0, "flow_id": "flow-1932d08084093fedefa1042a", "packets": 30, "transport": "udp", "last_frame": 12802, "first_frame": 1, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.1", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 3138, "last_seen_epoch": "1580346178.667654", "responder_bytes": 0, "first_seen_epoch": "1580345692.299272" }, { "bytes": 324, "stream": 1, "flow_id": "flow-d5e7a1faa90d5bc32ccd2c5f", "packets": 2, "transport": "udp", "last_frame": 4, "first_frame": 3, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58262, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1580345692.506101", "responder_bytes": 196, "first_seen_epoch": "1580345692.505473" }, { "bytes": 332, "stream": 2, "flow_id": "flow-a162b27b8f5fe15193a676d0", "packets": 2, "transport": "udp", "last_frame": 6, "first_frame": 5, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59510, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1580345692.61213", "responder_bytes": 200, "first_seen_epoch": "1580345692.611709" }, { "bytes": 513, "stream": 3, "flow_id": "flow-35837fd584de5f812741b6a0", "packets": 2, "transport": "udp", "last_frame": 8, "first_frame": 7, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59512, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345692.644895", "responder_bytes": 244, "first_seen_epoch": "1580345692.64441" }, { "bytes": 576, "stream": 4, "flow_id": "flow-f36224281e7e460edcc707fc", "packets": 2, "transport": "udp", "last_frame": 11, "first_frame": 9, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59513, "responder_port": 389, "initiator_bytes": 315, "last_seen_epoch": "1580345692.661841", "responder_bytes": 261, "first_seen_epoch": "1580345692.661303" }, { "bytes": 556, "stream": 5, "flow_id": "flow-d929cbad216646877b331ae3", "packets": 2, "transport": "udp", "last_frame": 12, "first_frame": 10, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59514, "responder_port": 389, "initiator_bytes": 312, "last_seen_epoch": "1580345692.661884", "responder_bytes": 244, "first_seen_epoch": "1580345692.661358" }, { "bytes": 512, "stream": 6, "flow_id": "flow-4e0cd635cf4dd9c61d2f5295", "packets": 2, "transport": "udp", "last_frame": 14, "first_frame": 13, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59515, "responder_port": 389, "initiator_bytes": 268, "last_seen_epoch": "1580345692.662766", "responder_bytes": 244, "first_seen_epoch": "1580345692.662516" }, { "bytes": 936, "stream": 0, "flow_id": "flow-c190fada67f797d69200b03d", "packets": 8, "transport": "tcp", "last_frame": 22, "first_frame": 15, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49671, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1580345692.78369", "responder_bytes": 460, "first_seen_epoch": "1580345692.773443" }, { "bytes": 4372, "stream": 1, "flow_id": "flow-fa4d55d487f23199963cdc13", "packets": 26, "transport": "tcp", "last_frame": 1026, "first_frame": 23, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49672, "responder_port": 135, "initiator_bytes": 2104, "last_seen_epoch": "1580345718.421372", "responder_bytes": 2268, "first_seen_epoch": "1580345692.785148" }, { "bytes": 4560, "stream": 2, "flow_id": "flow-3e1b8fa6dfaef3b8aea788d1", "packets": 20, "transport": "tcp", "last_frame": 1027, "first_frame": 30, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49673, "responder_port": 49675, "initiator_bytes": 2646, "last_seen_epoch": "1580345718.421491", "responder_bytes": 1914, "first_seen_epoch": "1580345692.790332" }, { "bytes": 2559, "stream": 3, "flow_id": "flow-c7dfc53f40d351e02a74d663", "packets": 10, "transport": "tcp", "last_frame": 52, "first_frame": 43, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49674, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1580345692.806117", "responder_bytes": 1949, "first_seen_epoch": "1580345692.803882" }, { "bytes": 9995, "stream": 4, "flow_id": "flow-b5427daaa972fb6e17194301", "packets": 32, "transport": "tcp", "last_frame": 254, "first_frame": 56, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49675, "responder_port": 389, "initiator_bytes": 4829, "last_seen_epoch": "1580345693.32184", "responder_bytes": 5166, "first_seen_epoch": "1580345692.818637" }, { "bytes": 936, "stream": 5, "flow_id": "flow-1eb7758998bbd138928086bc", "packets": 8, "transport": "tcp", "last_frame": 70, "first_frame": 63, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49676, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1580345692.825166", "responder_bytes": 460, "first_seen_epoch": "1580345692.823809" }, { "bytes": 4107, "stream": 6, "flow_id": "flow-ab37e94982176056f4a3d145", "packets": 12, "transport": "tcp", "last_frame": 85, "first_frame": 71, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49677, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1580345692.837314", "responder_bytes": 2045, "first_seen_epoch": "1580345692.829943" }, { "bytes": 2559, "stream": 7, "flow_id": "flow-595d8cda658fbbd13bb302b6", "packets": 10, "transport": "tcp", "last_frame": 92, "first_frame": 80, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49678, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1580345692.840384", "responder_bytes": 1949, "first_seen_epoch": "1580345692.836713" }, { "bytes": 4107, "stream": 8, "flow_id": "flow-c117f955887f11640697fe9c", "packets": 12, "transport": "tcp", "last_frame": 111, "first_frame": 94, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49679, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1580345692.848418", "responder_bytes": 2045, "first_seen_epoch": "1580345692.846151" }, { "bytes": 21428, "stream": 9, "flow_id": "flow-e0522bf045bd8d7d07af971b", "packets": 67, "transport": "tcp", "last_frame": 1050, "first_frame": 101, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49680, "responder_port": 49675, "initiator_bytes": 14626, "last_seen_epoch": "1580345748.417345", "responder_bytes": 6802, "first_seen_epoch": "1580345692.846985" }, { "bytes": 4107, "stream": 10, "flow_id": "flow-c67d622f39d020ec37e3227a", "packets": 12, "transport": "tcp", "last_frame": 125, "first_frame": 107, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49681, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1580345692.850597", "responder_bytes": 2045, "first_seen_epoch": "1580345692.848159" }, { "bytes": 334, "stream": 7, "flow_id": "flow-5a4cf781547176980323a8ec", "packets": 2, "transport": "udp", "last_frame": 158, "first_frame": 157, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59575, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1580345692.876703", "responder_bytes": 201, "first_seen_epoch": "1580345692.876379" }, { "bytes": 493, "stream": 8, "flow_id": "flow-ddd358b8659d1077f7f3c003", "packets": 2, "transport": "udp", "last_frame": 160, "first_frame": 159, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59576, "responder_port": 389, "initiator_bytes": 247, "last_seen_epoch": "1580345692.890248", "responder_bytes": 246, "first_seen_epoch": "1580345692.889937" }, { "bytes": 348, "stream": 11, "flow_id": "flow-4627f7b6588d6c7f5a7936cb", "packets": 6, "transport": "tcp", "last_frame": 170, "first_frame": 164, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49682, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1580345693.005604", "responder_bytes": 174, "first_seen_epoch": "1580345693.004443" }, { "bytes": 334, "stream": 9, "flow_id": "flow-e4dce1011320fe967094e86f", "packets": 2, "transport": "udp", "last_frame": 173, "first_frame": 172, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58111, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1580345693.006461", "responder_bytes": 201, "first_seen_epoch": "1580345693.006207" }, { "bytes": 493, "stream": 10, "flow_id": "flow-05534242035ad70a95745570", "packets": 2, "transport": "udp", "last_frame": 176, "first_frame": 175, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58112, "responder_port": 389, "initiator_bytes": 247, "last_seen_epoch": "1580345693.101555", "responder_bytes": 246, "first_seen_epoch": "1580345693.101135" }, { "bytes": 348, "stream": 12, "flow_id": "flow-36ce51ab975da87ad51c66dd", "packets": 6, "transport": "tcp", "last_frame": 183, "first_frame": 177, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49683, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1580345693.208717", "responder_bytes": 174, "first_seen_epoch": "1580345693.207352" }, { "bytes": 304, "stream": 11, "flow_id": "flow-e0390a59c8ace2033ebbcab8", "packets": 2, "transport": "udp", "last_frame": 186, "first_frame": 185, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57103, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1580345693.209304", "responder_bytes": 186, "first_seen_epoch": "1580345693.209115" }, { "bytes": 512, "stream": 12, "flow_id": "flow-afd750df2b57607a18bccb24", "packets": 2, "transport": "udp", "last_frame": 188, "first_frame": 187, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57104, "responder_port": 389, "initiator_bytes": 268, "last_seen_epoch": "1580345693.209997", "responder_bytes": 244, "first_seen_epoch": "1580345693.209759" }, { "bytes": 44411, "stream": 13, "flow_id": "flow-f6b7bd31306fdbf23480923e", "packets": 169, "transport": "tcp", "last_frame": 7707, "first_frame": 189, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49684, "responder_port": 445, "initiator_bytes": 23094, "last_seen_epoch": "1580345876.235905", "responder_bytes": 21317, "first_seen_epoch": "1580345693.221678" }, { "bytes": 4069, "stream": 14, "flow_id": "flow-1042325dde58c928fa8005d6", "packets": 12, "transport": "tcp", "last_frame": 208, "first_frame": 196, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49685, "responder_port": 88, "initiator_bytes": 2044, "last_seen_epoch": "1580345693.253229", "responder_bytes": 2025, "first_seen_epoch": "1580345693.251448" }, { "bytes": 3703, "stream": 15, "flow_id": "flow-747a6b835e54d1e32f378d3a", "packets": 12, "transport": "tcp", "last_frame": 220, "first_frame": 209, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49686, "responder_port": 88, "initiator_bytes": 1837, "last_seen_epoch": "1580345693.254313", "responder_bytes": 1866, "first_seen_epoch": "1580345693.253278" }, { "bytes": 348, "stream": 16, "flow_id": "flow-d20377ec31ef15cf540fdacd", "packets": 6, "transport": "tcp", "last_frame": 239, "first_frame": 233, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49687, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1580345693.318203", "responder_bytes": 174, "first_seen_epoch": "1580345693.316778" }, { "bytes": 348, "stream": 17, "flow_id": "flow-449de67c16bc245fa6b64fc4", "packets": 6, "transport": "tcp", "last_frame": 247, "first_frame": 241, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49688, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1580345693.319772", "responder_bytes": 174, "first_seen_epoch": "1580345693.319005" }, { "bytes": 200, "stream": 13, "flow_id": "flow-3ad9d3fd2a8594bf1738a5d6", "packets": 2, "transport": "udp", "last_frame": 277, "first_frame": 276, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 53811, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1580345693.606441", "responder_bytes": 108, "first_seen_epoch": "1580345693.606109" }, { "bytes": 9049, "stream": 18, "flow_id": "flow-be3919ad09698aad30521372", "packets": 21, "transport": "tcp", "last_frame": 477, "first_frame": 281, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49690, "responder_port": 389, "initiator_bytes": 3796, "last_seen_epoch": "1580345694.422568", "responder_bytes": 5253, "first_seen_epoch": "1580345694.043123" }, { "bytes": 4003, "stream": 19, "flow_id": "flow-4ef36e423381a8d5313b299c", "packets": 12, "transport": "tcp", "last_frame": 304, "first_frame": 293, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49691, "responder_port": 88, "initiator_bytes": 2022, "last_seen_epoch": "1580345694.0789", "responder_bytes": 1981, "first_seen_epoch": "1580345694.075926" }, { "bytes": 3774, "stream": 20, "flow_id": "flow-eab30ef043257561c01f125e", "packets": 16, "transport": "tcp", "last_frame": 470, "first_frame": 307, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49692, "responder_port": 389, "initiator_bytes": 2864, "last_seen_epoch": "1580345694.350151", "responder_bytes": 910, "first_seen_epoch": "1580345694.092151" }, { "bytes": 4107, "stream": 21, "flow_id": "flow-bdba8278b20a0e80c8f380f8", "packets": 12, "transport": "tcp", "last_frame": 332, "first_frame": 321, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49693, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1580345694.137356", "responder_bytes": 2045, "first_seen_epoch": "1580345694.134459" }, { "bytes": 3703, "stream": 22, "flow_id": "flow-3b6df5f0ce6a9867182bbf54", "packets": 12, "transport": "tcp", "last_frame": 344, "first_frame": 333, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49694, "responder_port": 88, "initiator_bytes": 1837, "last_seen_epoch": "1580345694.138324", "responder_bytes": 1866, "first_seen_epoch": "1580345694.137491" }, { "bytes": 263, "stream": 14, "flow_id": "flow-4b6bb92f38c30fd883f6b2e6", "packets": 2, "transport": "udp", "last_frame": 479, "first_frame": 478, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 51314, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1580345694.867451", "responder_bytes": 171, "first_seen_epoch": "1580345694.86723" }, { "bytes": 320, "stream": 15, "flow_id": "flow-188ae35bce915f05a812d2de", "packets": 2, "transport": "udp", "last_frame": 481, "first_frame": 480, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57221, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1580345694.870229", "responder_bytes": 160, "first_seen_epoch": "1580345694.86899" }, { "bytes": 247, "stream": 16, "flow_id": "flow-e52c3bec23a3872952f05692", "packets": 2, "transport": "udp", "last_frame": 484, "first_frame": 483, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57433, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580345695.26086", "responder_bytes": 171, "first_seen_epoch": "1580345695.240525" }, { "bytes": 2548, "stream": 23, "flow_id": "flow-e3d54d9a7f59bf58231ba790", "packets": 12, "transport": "tcp", "last_frame": 498, "first_frame": 485, "initiator_ip": "10.20.30.227", "responder_ip": "23.51.186.146", "initiator_port": 49696, "responder_port": 80, "initiator_bytes": 1924, "last_seen_epoch": "1580345695.379271", "responder_bytes": 624, "first_seen_epoch": "1580345695.265101" }, { "bytes": 305, "stream": 17, "flow_id": "flow-035dc16b67ae5c7cfef0ff73", "packets": 2, "transport": "udp", "last_frame": 500, "first_frame": 499, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59248, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1580345695.400755", "responder_bytes": 215, "first_seen_epoch": "1580345695.38166" }, { "bytes": 9254, "stream": 24, "flow_id": "flow-64452e422bf8da96a90ccf5e", "packets": 20, "transport": "tcp", "last_frame": 1043, "first_frame": 501, "initiator_ip": "10.20.30.227", "responder_ip": "40.67.249.61", "initiator_port": 49697, "responder_port": 80, "initiator_bytes": 4520, "last_seen_epoch": "1580345741.155491", "responder_bytes": 4734, "first_seen_epoch": "1580345695.401455" }, { "bytes": 3408, "stream": 25, "flow_id": "flow-67e26ea6a93b10c0351bc76d", "packets": 13, "transport": "tcp", "last_frame": 527, "first_frame": 511, "initiator_ip": "10.20.30.227", "responder_ip": "23.51.186.146", "initiator_port": 49698, "responder_port": 80, "initiator_bytes": 2784, "last_seen_epoch": "1580345695.892043", "responder_bytes": 624, "first_seen_epoch": "1580345695.778624" }, { "bytes": 324, "stream": 18, "flow_id": "flow-7e3899edcbc5503e64ff2883", "packets": 2, "transport": "udp", "last_frame": 513, "first_frame": 512, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52243, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1580345695.800856", "responder_bytes": 196, "first_seen_epoch": "1580345695.800643" }, { "bytes": 513, "stream": 19, "flow_id": "flow-6f0ef96241631d83f5bc54a5", "packets": 2, "transport": "udp", "last_frame": 515, "first_frame": 514, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52244, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345695.801646", "responder_bytes": 244, "first_seen_epoch": "1580345695.801451" }, { "bytes": 1704, "stream": 26, "flow_id": "flow-138bfaa3f641b78ccee6016b", "packets": 10, "transport": "tcp", "last_frame": 603, "first_frame": 534, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49699, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1580345695.94846", "responder_bytes": 872, "first_seen_epoch": "1580345695.920833" }, { "bytes": 6711, "stream": 27, "flow_id": "flow-dfeb54e76e768b448f9e829a", "packets": 22, "transport": "tcp", "last_frame": 604, "first_frame": 541, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49700, "responder_port": 49675, "initiator_bytes": 4290, "last_seen_epoch": "1580345695.948634", "responder_bytes": 2421, "first_seen_epoch": "1580345695.92451" }, { "bytes": 7492, "stream": 28, "flow_id": "flow-fa6fdd05e0f099d9fc83d7a3", "packets": 21, "transport": "tcp", "last_frame": 602, "first_frame": 564, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49701, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1580345695.944998", "responder_bytes": 4061, "first_seen_epoch": "1580345695.934366" }, { "bytes": 6906, "stream": 29, "flow_id": "flow-229fa4202b0dbe93ed7c1dcb", "packets": 18, "transport": "tcp", "last_frame": 599, "first_frame": 581, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49702, "responder_port": 389, "initiator_bytes": 2831, "last_seen_epoch": "1580345695.944773", "responder_bytes": 4075, "first_seen_epoch": "1580345695.940847" }, { "bytes": 3528, "stream": 20, "flow_id": "flow-de9b41866d092aff5fd00989", "packets": 36, "transport": "udp", "last_frame": 12806, "first_frame": 609, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 3528, "last_seen_epoch": "1580346181.763084", "responder_bytes": 0, "first_seen_epoch": "1580345696.847984" }, { "bytes": 513, "stream": 21, "flow_id": "flow-a09fc9ba18724d54c6e29a23", "packets": 2, "transport": "udp", "last_frame": 621, "first_frame": 620, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52247, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345700.562218", "responder_bytes": 244, "first_seen_epoch": "1580345700.56191" }, { "bytes": 8393, "stream": 30, "flow_id": "flow-2bbfa5fefdd65f4abd643e06", "packets": 26, "transport": "tcp", "last_frame": 693, "first_frame": 623, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49703, "responder_port": 389, "initiator_bytes": 3975, "last_seen_epoch": "1580345700.838843", "responder_bytes": 4418, "first_seen_epoch": "1580345700.676623" }, { "bytes": 513, "stream": 22, "flow_id": "flow-55072cbaeab62ec2d4f0df75", "packets": 2, "transport": "udp", "last_frame": 645, "first_frame": 644, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52248, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345700.693644", "responder_bytes": 244, "first_seen_epoch": "1580345700.693364" }, { "bytes": 4385, "stream": 31, "flow_id": "flow-8bdffd47b388d908047a8f0e", "packets": 13, "transport": "tcp", "last_frame": 689, "first_frame": 647, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49704, "responder_port": 389, "initiator_bytes": 3569, "last_seen_epoch": "1580345700.831823", "responder_bytes": 816, "first_seen_epoch": "1580345700.803235" }, { "bytes": 955, "stream": 32, "flow_id": "flow-e4e0bbc4de59210687684859", "packets": 8, "transport": "tcp", "last_frame": 664, "first_frame": 656, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49705, "responder_port": 88, "initiator_bytes": 477, "last_seen_epoch": "1580345700.815768", "responder_bytes": 478, "first_seen_epoch": "1580345700.814536" }, { "bytes": 2560, "stream": 33, "flow_id": "flow-0a413d1b31fa1b3e3a2c9448", "packets": 10, "transport": "tcp", "last_frame": 673, "first_frame": 663, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49706, "responder_port": 88, "initiator_bytes": 611, "last_seen_epoch": "1580345700.817148", "responder_bytes": 1949, "first_seen_epoch": "1580345700.815755" }, { "bytes": 3941, "stream": 34, "flow_id": "flow-790ab700c6da3e174707062c", "packets": 12, "transport": "tcp", "last_frame": 685, "first_frame": 674, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49707, "responder_port": 88, "initiator_bytes": 1988, "last_seen_epoch": "1580345700.827432", "responder_bytes": 1953, "first_seen_epoch": "1580345700.817276" }, { "bytes": 486, "stream": 23, "flow_id": "flow-2134753cd2fe799b5763ebfe", "packets": 2, "transport": "udp", "last_frame": 7718, "first_frame": 694, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 486, "last_seen_epoch": "1580345938.809515", "responder_bytes": 0, "first_seen_epoch": "1580345701.362494" }, { "bytes": 324, "stream": 24, "flow_id": "flow-fb8109f6eeb7e2ab11cc7057", "packets": 2, "transport": "udp", "last_frame": 696, "first_frame": 695, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 162, "last_seen_epoch": "1580345702.866029", "responder_bytes": 162, "first_seen_epoch": "1580345702.865093" }, { "bytes": 513, "stream": 25, "flow_id": "flow-2b54be5a8e5c2cfffd8486d7", "packets": 2, "transport": "udp", "last_frame": 698, "first_frame": 697, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52249, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345703.491402", "responder_bytes": 244, "first_seen_epoch": "1580345703.491041" }, { "bytes": 902, "stream": 35, "flow_id": "flow-301dbb056f0e8a18e1b3c822", "packets": 8, "transport": "tcp", "last_frame": 706, "first_frame": 699, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49708, "responder_port": 88, "initiator_bytes": 469, "last_seen_epoch": "1580345703.606227", "responder_bytes": 433, "first_seen_epoch": "1580345703.598187" }, { "bytes": 2575, "stream": 36, "flow_id": "flow-1ad0c7298c9ecec420dd87d2", "packets": 10, "transport": "tcp", "last_frame": 716, "first_frame": 707, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49709, "responder_port": 88, "initiator_bytes": 603, "last_seen_epoch": "1580345703.616189", "responder_bytes": 1972, "first_seen_epoch": "1580345703.611795" }, { "bytes": 3892, "stream": 37, "flow_id": "flow-8b19697721164ea3e6da45ea", "packets": 12, "transport": "tcp", "last_frame": 728, "first_frame": 717, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49710, "responder_port": 88, "initiator_bytes": 1931, "last_seen_epoch": "1580345703.62183", "responder_bytes": 1961, "first_seen_epoch": "1580345703.616316" }, { "bytes": 250, "stream": 26, "flow_id": "flow-6e812c7291bc4300320eec4e", "packets": 2, "transport": "udp", "last_frame": 730, "first_frame": 729, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58118, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1580345703.932605", "responder_bytes": 160, "first_seen_epoch": "1580345703.914322" }, { "bytes": 10603, "stream": 38, "flow_id": "flow-55a48862eed952889a0aec80", "packets": 27, "transport": "tcp", "last_frame": 7631, "first_frame": 731, "initiator_ip": "10.20.30.227", "responder_ip": "52.114.75.79", "initiator_port": 49711, "responder_port": 443, "initiator_bytes": 3334, "last_seen_epoch": "1580345813.715746", "responder_bytes": 7269, "first_seen_epoch": "1580345703.936437" }, { "bytes": 4137, "stream": 39, "flow_id": "flow-57e1e6b1e36ae89919f3f965", "packets": 11, "transport": "tcp", "last_frame": 748, "first_frame": 734, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49712, "responder_port": 88, "initiator_bytes": 2050, "last_seen_epoch": "1580345703.960935", "responder_bytes": 2087, "first_seen_epoch": "1580345703.958232" }, { "bytes": 168, "stream": 27, "flow_id": "flow-514f6f1b5061760233373de2", "packets": 2, "transport": "udp", "last_frame": 764, "first_frame": 763, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 56134, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580345703.984249", "responder_bytes": 92, "first_seen_epoch": "1580345703.983963" }, { "bytes": 14355, "stream": 40, "flow_id": "flow-39102a6685fe9c50a8256c18", "packets": 62, "transport": "tcp", "last_frame": 1001, "first_frame": 766, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49713, "responder_port": 445, "initiator_bytes": 7119, "last_seen_epoch": "1580345714.679002", "responder_bytes": 7236, "first_seen_epoch": "1580345703.996989" }, { "bytes": 2404, "stream": 41, "flow_id": "flow-634ddda8d897601ee51ca392", "packets": 10, "transport": "tcp", "last_frame": 784, "first_frame": 775, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49714, "responder_port": 88, "initiator_bytes": 2016, "last_seen_epoch": "1580345704.008989", "responder_bytes": 388, "first_seen_epoch": "1580345704.006827" }, { "bytes": 10584, "stream": 42, "flow_id": "flow-381a572089f6138f4fdd7507", "packets": 52, "transport": "tcp", "last_frame": 12851, "first_frame": 838, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49715, "responder_port": 445, "initiator_bytes": 7272, "last_seen_epoch": "1580346227.808011", "responder_bytes": 3312, "first_seen_epoch": "1580345704.200261" }, { "bytes": 4102, "stream": 43, "flow_id": "flow-d72ab1b033694d9a4a3b5147", "packets": 12, "transport": "tcp", "last_frame": 856, "first_frame": 845, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49716, "responder_port": 88, "initiator_bytes": 2069, "last_seen_epoch": "1580345704.209604", "responder_bytes": 2033, "first_seen_epoch": "1580345704.207863" }, { "bytes": 3787, "stream": 44, "flow_id": "flow-612fd21b21d85d5a82ae3b16", "packets": 12, "transport": "tcp", "last_frame": 868, "first_frame": 857, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49717, "responder_port": 88, "initiator_bytes": 1879, "last_seen_epoch": "1580345704.211658", "responder_bytes": 1908, "first_seen_epoch": "1580345704.209804" }, { "bytes": 4305, "stream": 45, "flow_id": "flow-6b2cf5c10419f45c38a7f00d", "packets": 14, "transport": "tcp", "last_frame": 932, "first_frame": 890, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49718, "responder_port": 389, "initiator_bytes": 3215, "last_seen_epoch": "1580345704.695177", "responder_bytes": 1090, "first_seen_epoch": "1580345704.327079" }, { "bytes": 3840, "stream": 46, "flow_id": "flow-83f34df7a3e1a44700a0a757", "packets": 16, "transport": "tcp", "last_frame": 930, "first_frame": 899, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49719, "responder_port": 389, "initiator_bytes": 2930, "last_seen_epoch": "1580345704.689842", "responder_bytes": 910, "first_seen_epoch": "1580345704.340202" }, { "bytes": 270, "stream": 28, "flow_id": "flow-13c35d940dcd1fd3917ff700", "packets": 2, "transport": "udp", "last_frame": 937, "first_frame": 936, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 61279, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1580345705.53062", "responder_bytes": 188, "first_seen_epoch": "1580345705.324217" }, { "bytes": 8563, "stream": 47, "flow_id": "flow-274321d79319048e3b77480c", "packets": 30, "transport": "tcp", "last_frame": 7674, "first_frame": 938, "initiator_ip": "10.20.30.227", "responder_ip": "52.242.211.89", "initiator_port": 49720, "responder_port": 443, "initiator_bytes": 3163, "last_seen_epoch": "1580345870.826447", "responder_bytes": 5400, "first_seen_epoch": "1580345705.538625" }, { "bytes": 241, "stream": 29, "flow_id": "flow-dd7d9b1e8839925700c249f7", "packets": 2, "transport": "udp", "last_frame": 966, "first_frame": 965, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 64462, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1580345706.619407", "responder_bytes": 160, "first_seen_epoch": "1580345706.619144" }, { "bytes": 227, "stream": 30, "flow_id": "flow-528a92a3469bf4aa9a6ed1a1", "packets": 2, "transport": "udp", "last_frame": 968, "first_frame": 967, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59353, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580345706.619934", "responder_bytes": 151, "first_seen_epoch": "1580345706.619777" }, { "bytes": 265, "stream": 31, "flow_id": "flow-f3cf8dd91f99a4f07c4cbd2e", "packets": 2, "transport": "udp", "last_frame": 970, "first_frame": 969, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57099, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1580345708.5791", "responder_bytes": 193, "first_seen_epoch": "1580345708.560332" }, { "bytes": 15246, "stream": 48, "flow_id": "flow-79397837bbf34fd51627a81e", "packets": 45, "transport": "tcp", "last_frame": 7642, "first_frame": 971, "initiator_ip": "10.20.30.227", "responder_ip": "204.79.197.200", "initiator_port": 49721, "responder_port": 443, "initiator_bytes": 7682, "last_seen_epoch": "1580345848.204573", "responder_bytes": 7564, "first_seen_epoch": "1580345708.619795" }, { "bytes": 1770, "stream": 49, "flow_id": "flow-d3892c973f9bde9be515896a", "packets": 11, "transport": "tcp", "last_frame": 1142, "first_frame": 1051, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49722, "responder_port": 135, "initiator_bytes": 898, "last_seen_epoch": "1580345752.568434", "responder_bytes": 872, "first_seen_epoch": "1580345751.388652" }, { "bytes": 6819, "stream": 50, "flow_id": "flow-a30c734fb51536d0e12456d2", "packets": 23, "transport": "tcp", "last_frame": 1143, "first_frame": 1058, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49723, "responder_port": 49675, "initiator_bytes": 4398, "last_seen_epoch": "1580345752.568562", "responder_bytes": 2421, "first_seen_epoch": "1580345751.3937" }, { "bytes": 7534, "stream": 51, "flow_id": "flow-1fcfab72ce776c3ca91bfcc4", "packets": 21, "transport": "tcp", "last_frame": 1119, "first_frame": 1081, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49724, "responder_port": 389, "initiator_bytes": 3473, "last_seen_epoch": "1580345751.425637", "responder_bytes": 4061, "first_seen_epoch": "1580345751.409654" }, { "bytes": 6948, "stream": 52, "flow_id": "flow-e89b7a92d0c739030af10d1a", "packets": 18, "transport": "tcp", "last_frame": 1116, "first_frame": 1098, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49725, "responder_port": 389, "initiator_bytes": 2873, "last_seen_epoch": "1580345751.425378", "responder_bytes": 4075, "first_seen_epoch": "1580345751.420204" }, { "bytes": 375, "stream": 32, "flow_id": "flow-2f9d4ffffffce8fb2491a66c", "packets": 2, "transport": "udp", "last_frame": 1123, "first_frame": 1122, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 53429, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1580345751.503989", "responder_bytes": 290, "first_seen_epoch": "1580345751.490053" }, { "bytes": 7426, "stream": 53, "flow_id": "flow-7f741f87a35f6fdd69881e9d", "packets": 19, "transport": "tcp", "last_frame": 1144, "first_frame": 1124, "initiator_ip": "10.20.30.227", "responder_ip": "40.126.0.67", "initiator_port": 49726, "responder_port": 443, "initiator_bytes": 1431, "last_seen_epoch": "1580345752.568999", "responder_bytes": 5995, "first_seen_epoch": "1580345751.5048" }, { "bytes": 300, "stream": 33, "flow_id": "flow-dd1caaa81f0ddc9964c96a82", "packets": 2, "transport": "udp", "last_frame": 1146, "first_frame": 1145, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52094, "responder_port": 53, "initiator_bytes": 116, "last_seen_epoch": "1580345753.345199", "responder_bytes": 184, "first_seen_epoch": "1580345753.344667" }, { "bytes": 477, "stream": 34, "flow_id": "flow-d377d6c9e56e773d2bfaa73d", "packets": 2, "transport": "udp", "last_frame": 1148, "first_frame": 1147, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52095, "responder_port": 389, "initiator_bytes": 233, "last_seen_epoch": "1580345753.34664", "responder_bytes": 244, "first_seen_epoch": "1580345753.34615" }, { "bytes": 6924, "stream": 54, "flow_id": "flow-624509d44175b3c886020c9d", "packets": 15, "transport": "tcp", "last_frame": 1163, "first_frame": 1149, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49727, "responder_port": 3268, "initiator_bytes": 3166, "last_seen_epoch": "1580345753.495182", "responder_bytes": 3758, "first_seen_epoch": "1580345753.456862" }, { "bytes": 172, "stream": 35, "flow_id": "flow-10197a2e78daafa9cd38b558", "packets": 2, "transport": "udp", "last_frame": 1165, "first_frame": 1164, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 56177, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1580345757.512836", "responder_bytes": 94, "first_seen_epoch": "1580345757.280076" }, { "bytes": 86460, "stream": 55, "flow_id": "flow-2336096abdd57f116bc66876", "packets": 75, "transport": "tcp", "last_frame": 7657, "first_frame": 1166, "initiator_ip": "10.20.30.227", "responder_ip": "49.51.133.162", "initiator_port": 49728, "responder_port": 80, "initiator_bytes": 938, "last_seen_epoch": "1580345867.235598", "responder_bytes": 85522, "first_seen_epoch": "1580345757.527582" }, { "bytes": 372, "stream": 36, "flow_id": "flow-218e6c01bb6cc5b9cfbccbdb", "packets": 2, "transport": "udp", "last_frame": 1238, "first_frame": 1237, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49446, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1580345758.355581", "responder_bytes": 299, "first_seen_epoch": "1580345758.330226" }, { "bytes": 961, "stream": 56, "flow_id": "flow-f3f0c7bd249f00d913906413", "packets": 11, "transport": "tcp", "last_frame": 7665, "first_frame": 1239, "initiator_ip": "10.20.30.227", "responder_ip": "184.73.165.106", "initiator_port": 49729, "responder_port": 80, "initiator_bytes": 500, "last_seen_epoch": "1580345868.311551", "responder_bytes": 461, "first_seen_epoch": "1580345758.363377" }, { "bytes": 164, "stream": 37, "flow_id": "flow-d1fed93755e0550d05d5885e", "packets": 2, "transport": "udp", "last_frame": 1247, "first_frame": 1246, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 53286, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1580345758.668788", "responder_bytes": 90, "first_seen_epoch": "1580345758.460647" }, { "bytes": 1621, "stream": 57, "flow_id": "flow-6b577524d17bc186ffe89a8e", "packets": 11, "transport": "tcp", "last_frame": 7663, "first_frame": 1248, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49730, "responder_port": 80, "initiator_bytes": 718, "last_seen_epoch": "1580345868.311336", "responder_bytes": 903, "first_seen_epoch": "1580345758.669774" }, { "bytes": 172, "stream": 38, "flow_id": "flow-8bd45f28c5238c31741fcc9e", "packets": 2, "transport": "udp", "last_frame": 1256, "first_frame": 1255, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 63575, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1580345759.142249", "responder_bytes": 94, "first_seen_epoch": "1580345759.048081" }, { "bytes": 100087, "stream": 58, "flow_id": "flow-4e86e2949920d5e1b3ee5e1c", "packets": 101, "transport": "tcp", "last_frame": 3490, "first_frame": 1257, "initiator_ip": "10.20.30.227", "responder_ip": "148.66.137.40", "initiator_port": 49731, "responder_port": 80, "initiator_bytes": 2052, "last_seen_epoch": "1580345764.89901", "responder_bytes": 98035, "first_seen_epoch": "1580345759.143023" }, { "bytes": 164, "stream": 39, "flow_id": "flow-995f2721a7d5eca1445c5bb8", "packets": 2, "transport": "udp", "last_frame": 1309, "first_frame": 1308, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59675, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1580345760.482013", "responder_bytes": 90, "first_seen_epoch": "1580345760.48166" }, { "bytes": 1304, "stream": 59, "flow_id": "flow-8225fb6fde1bc9aa2d607187", "packets": 11, "transport": "tcp", "last_frame": 1320, "first_frame": 1310, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49732, "responder_port": 80, "initiator_bytes": 862, "last_seen_epoch": "1580345761.031438", "responder_bytes": 442, "first_seen_epoch": "1580345760.483104" }, { "bytes": 2424136, "stream": 60, "flow_id": "flow-f8924ccaf13304b807b29446", "packets": 6100, "transport": "tcp", "last_frame": 7624, "first_frame": 1321, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49733, "responder_port": 49675, "initiator_bytes": 1796662, "last_seen_epoch": "1580345808.420162", "responder_bytes": 627474, "first_seen_epoch": "1580345761.049701" }, { "bytes": 250, "stream": 40, "flow_id": "flow-d52165048e049a32086a6718", "packets": 2, "transport": "udp", "last_frame": 1356, "first_frame": 1327, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 51244, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1580345761.097005", "responder_bytes": 160, "first_seen_epoch": "1580345761.053095" }, { "bytes": 13654, "stream": 61, "flow_id": "flow-14146967fa24d00ace737ce0", "packets": 31, "transport": "tcp", "last_frame": 7659, "first_frame": 1358, "initiator_ip": "10.20.30.227", "responder_ip": "52.114.132.22", "initiator_port": 49734, "responder_port": 443, "initiator_bytes": 8119, "last_seen_epoch": "1580345867.275617", "responder_bytes": 5535, "first_seen_epoch": "1580345761.098053" }, { "bytes": 270, "stream": 41, "flow_id": "flow-3e915e0082f6b4c31038932e", "packets": 2, "transport": "udp", "last_frame": 3467, "first_frame": 3466, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 64131, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1580345764.848131", "responder_bytes": 188, "first_seen_epoch": "1580345764.847758" }, { "bytes": 7701, "stream": 62, "flow_id": "flow-1d700361afe7506cde27824f", "packets": 25, "transport": "tcp", "last_frame": 3588, "first_frame": 3468, "initiator_ip": "10.20.30.227", "responder_ip": "52.242.211.89", "initiator_port": 49735, "responder_port": 443, "initiator_bytes": 2531, "last_seen_epoch": "1580345765.167947", "responder_bytes": 5170, "first_seen_epoch": "1580345764.848626" }, { "bytes": 324, "stream": 42, "flow_id": "flow-c226e99f33be0ab2c34b7a8f", "packets": 2, "transport": "udp", "last_frame": 3474, "first_frame": 3473, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 50762, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1580345764.8918", "responder_bytes": 196, "first_seen_epoch": "1580345764.891393" }, { "bytes": 513, "stream": 43, "flow_id": "flow-763a52593ac54fdb1ab5037c", "packets": 2, "transport": "udp", "last_frame": 3476, "first_frame": 3475, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 50763, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345764.893377", "responder_bytes": 244, "first_seen_epoch": "1580345764.893013" }, { "bytes": 1330, "stream": 63, "flow_id": "flow-ea0ffab13b521527306912f1", "packets": 11, "transport": "tcp", "last_frame": 3592, "first_frame": 3504, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49736, "responder_port": 80, "initiator_bytes": 895, "last_seen_epoch": "1580345765.579931", "responder_bytes": 435, "first_seen_epoch": "1580345764.992769" }, { "bytes": 1704, "stream": 64, "flow_id": "flow-e6e5fe1d25822159d2e91516", "packets": 10, "transport": "tcp", "last_frame": 3575, "first_frame": 3505, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49737, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1580345765.042669", "responder_bytes": 872, "first_seen_epoch": "1580345765.007502" }, { "bytes": 6711, "stream": 65, "flow_id": "flow-f449924f0fdc08477f9582d3", "packets": 22, "transport": "tcp", "last_frame": 3576, "first_frame": 3512, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49738, "responder_port": 49675, "initiator_bytes": 4290, "last_seen_epoch": "1580345765.042926", "responder_bytes": 2421, "first_seen_epoch": "1580345765.012302" }, { "bytes": 7492, "stream": 66, "flow_id": "flow-1a0a82ae4d83c574669be81d", "packets": 21, "transport": "tcp", "last_frame": 3574, "first_frame": 3536, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49739, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1580345765.039867", "responder_bytes": 4061, "first_seen_epoch": "1580345765.022509" }, { "bytes": 6906, "stream": 67, "flow_id": "flow-5a48c47ba6bb023edfd274c8", "packets": 18, "transport": "tcp", "last_frame": 3570, "first_frame": 3553, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49740, "responder_port": 389, "initiator_bytes": 2831, "last_seen_epoch": "1580345765.03927", "responder_bytes": 4075, "first_seen_epoch": "1580345765.031955" }, { "bytes": 241, "stream": 44, "flow_id": "flow-daa12a7ee21775f60a602c5b", "packets": 2, "transport": "udp", "last_frame": 4575, "first_frame": 4573, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59127, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1580345766.626816", "responder_bytes": 160, "first_seen_epoch": "1580345766.626268" }, { "bytes": 227, "stream": 45, "flow_id": "flow-17d49d82fa38ea053db47d57", "packets": 2, "transport": "udp", "last_frame": 4578, "first_frame": 4577, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 63165, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580345766.628153", "responder_bytes": 151, "first_seen_epoch": "1580345766.627729" }, { "bytes": 283, "stream": 68, "flow_id": "flow-9109a587013bd75bdd3b5330", "packets": 2, "transport": "tcp", "last_frame": 7670, "first_frame": 7669, "initiator_ip": "52.242.211.89", "responder_ip": "10.20.30.227", "initiator_port": 443, "responder_port": 49775, "initiator_bytes": 229, "last_seen_epoch": "1580345870.779085", "responder_bytes": 54, "first_seen_epoch": "1580345870.778968" }, { "bytes": 310, "stream": 46, "flow_id": "flow-ec82ccb8f1e47b88675b495a", "packets": 2, "transport": "udp", "last_frame": 7672, "first_frame": 7671, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 56347, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1580345870.814698", "responder_bytes": 227, "first_seen_epoch": "1580345870.79464" }, { "bytes": 10563, "stream": 69, "flow_id": "flow-b6b58ed7a6ccc15a37120b61", "packets": 29, "transport": "tcp", "last_frame": 7702, "first_frame": 7673, "initiator_ip": "10.20.30.227", "responder_ip": "13.107.246.10", "initiator_port": 49741, "responder_port": 443, "initiator_bytes": 2797, "last_seen_epoch": "1580345871.095843", "responder_bytes": 7766, "first_seen_epoch": "1580345870.818905" }, { "bytes": 1195, "stream": 70, "flow_id": "flow-e09ce808cb7d192a712d573a", "packets": 11, "transport": "tcp", "last_frame": 7722, "first_frame": 7708, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49742, "responder_port": 80, "initiator_bytes": 718, "last_seen_epoch": "1580345978.314009", "responder_bytes": 477, "first_seen_epoch": "1580345884.940206" }, { "bytes": 245, "stream": 47, "flow_id": "flow-e20879a4da8c1faaf0dc8d7a", "packets": 2, "transport": "udp", "last_frame": 7724, "first_frame": 7723, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 50355, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1580345984.336546", "responder_bytes": 155, "first_seen_epoch": "1580345984.277983" }, { "bytes": 8885, "stream": 71, "flow_id": "flow-8ab5b7c9ce1e70f66ec30be5", "packets": 22, "transport": "tcp", "last_frame": 7862, "first_frame": 7725, "initiator_ip": "10.20.30.227", "responder_ip": "52.109.76.30", "initiator_port": 49743, "responder_port": 443, "initiator_bytes": 1612, "last_seen_epoch": "1580346094.407569", "responder_bytes": 7273, "first_seen_epoch": "1580345984.338131" }, { "bytes": 324, "stream": 48, "flow_id": "flow-062bdea04778a799491e9514", "packets": 2, "transport": "udp", "last_frame": 7746, "first_frame": 7745, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 54317, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1580345993.866483", "responder_bytes": 196, "first_seen_epoch": "1580345993.866175" }, { "bytes": 513, "stream": 49, "flow_id": "flow-8bd8bb0b154e075b628e05cd", "packets": 2, "transport": "udp", "last_frame": 7748, "first_frame": 7747, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 54318, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1580345993.867637", "responder_bytes": 244, "first_seen_epoch": "1580345993.867368" }, { "bytes": 1704, "stream": 72, "flow_id": "flow-90c4109d40b5e0bba3c83878", "packets": 10, "transport": "tcp", "last_frame": 7818, "first_frame": 7749, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49744, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1580345994.00693", "responder_bytes": 872, "first_seen_epoch": "1580345993.979639" }, { "bytes": 6711, "stream": 73, "flow_id": "flow-6317c04b528f66bf2bfbf1d3", "packets": 22, "transport": "tcp", "last_frame": 7819, "first_frame": 7756, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49745, "responder_port": 49675, "initiator_bytes": 4290, "last_seen_epoch": "1580345994.00708", "responder_bytes": 2421, "first_seen_epoch": "1580345993.983408" }, { "bytes": 7492, "stream": 74, "flow_id": "flow-8ce279a9e4657efcb7068c94", "packets": 21, "transport": "tcp", "last_frame": 7817, "first_frame": 7779, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49746, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1580345994.004911", "responder_bytes": 4061, "first_seen_epoch": "1580345993.993238" }, { "bytes": 6906, "stream": 75, "flow_id": "flow-a44314ee7d319e1b1aa6489f", "packets": 18, "transport": "tcp", "last_frame": 7813, "first_frame": 7796, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49747, "responder_port": 389, "initiator_bytes": 2831, "last_seen_epoch": "1580345994.004444", "responder_bytes": 4075, "first_seen_epoch": "1580345993.999772" }, { "bytes": 1195, "stream": 76, "flow_id": "flow-2c26cd5122fab24385cf51f4", "packets": 11, "transport": "tcp", "last_frame": 7858, "first_frame": 7820, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49748, "responder_port": 80, "initiator_bytes": 718, "last_seen_epoch": "1580346088.315033", "responder_bytes": 477, "first_seen_epoch": "1580346005.332669" }, { "bytes": 11988, "stream": 77, "flow_id": "flow-d22f3d3b5192bde60aa3438a", "packets": 29, "transport": "tcp", "last_frame": 7932, "first_frame": 7827, "initiator_ip": "10.20.30.227", "responder_ip": "52.114.75.79", "initiator_port": 49749, "responder_port": 443, "initiator_bytes": 4612, "last_seen_epoch": "1580346134.007401", "responder_bytes": 7376, "first_seen_epoch": "1580346023.875683" }, { "bytes": 9188, "stream": 78, "flow_id": "flow-d7c732311b5dccf104f912d0", "packets": 24, "transport": "tcp", "last_frame": 7912, "first_frame": 7865, "initiator_ip": "10.20.30.227", "responder_ip": "52.114.132.22", "initiator_port": 49750, "responder_port": 443, "initiator_bytes": 3871, "last_seen_epoch": "1580346113.981937", "responder_bytes": 5317, "first_seen_epoch": "1580346113.546097" }, { "bytes": 9041, "stream": 79, "flow_id": "flow-096951c2a7a35e45ec450b24", "packets": 24, "transport": "tcp", "last_frame": 7911, "first_frame": 7866, "initiator_ip": "10.20.30.227", "responder_ip": "52.114.132.22", "initiator_port": 49751, "responder_port": 443, "initiator_bytes": 3724, "last_seen_epoch": "1580346113.98048", "responder_bytes": 5317, "first_seen_epoch": "1580346113.586312" }, { "bytes": 1195, "stream": 80, "flow_id": "flow-c1fa100e6d328d7b3098ae7d", "packets": 11, "transport": "tcp", "last_frame": 12810, "first_frame": 7913, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49752, "responder_port": 80, "initiator_bytes": 718, "last_seen_epoch": "1580346198.487715", "responder_bytes": 477, "first_seen_epoch": "1580346125.709365" }, { "bytes": 241, "stream": 50, "flow_id": "flow-48f0889ec24601a529b02f19", "packets": 2, "transport": "udp", "last_frame": 7921, "first_frame": 7920, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 61977, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1580346133.530794", "responder_bytes": 160, "first_seen_epoch": "1580346133.530307" }, { "bytes": 227, "stream": 51, "flow_id": "flow-8a43a298727fd6dd2ea86e09", "packets": 2, "transport": "udp", "last_frame": 7923, "first_frame": 7922, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 54996, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580346133.532959", "responder_bytes": 151, "first_seen_epoch": "1580346133.532618" }, { "bytes": 1340, "stream": 52, "flow_id": "flow-e55cfd185fc2b302e38ea095", "packets": 18, "transport": "udp", "last_frame": 11068, "first_frame": 7925, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.251", "initiator_port": 5353, "responder_port": 5353, "initiator_bytes": 1340, "last_seen_epoch": "1580346176.658991", "responder_bytes": 0, "first_seen_epoch": "1580346133.536248" }, { "bytes": 128, "stream": 53, "flow_id": "flow-ca6d66883382e7d60e62a3b0", "packets": 2, "transport": "udp", "last_frame": 7930, "first_frame": 7926, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 52559, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1580346133.947928", "responder_bytes": 0, "first_seen_epoch": "1580346133.536724" }, { "bytes": 860, "stream": 54, "flow_id": "flow-29a3b9265ba566c59b2ee1d6", "packets": 4, "transport": "udp", "last_frame": 7978, "first_frame": 7927, "initiator_ip": "10.20.30.227", "responder_ip": "239.255.255.250", "initiator_port": 52560, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1580346136.621248", "responder_bytes": 0, "first_seen_epoch": "1580346133.604864" }, { "bytes": 241, "stream": 55, "flow_id": "flow-d83e3482fcca3d5014ee3d05", "packets": 2, "transport": "udp", "last_frame": 7937, "first_frame": 7936, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 55340, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1580346135.067724", "responder_bytes": 160, "first_seen_epoch": "1580346135.067261" }, { "bytes": 227, "stream": 56, "flow_id": "flow-220bc78c5f6c543dd85e3283", "packets": 2, "transport": "udp", "last_frame": 7939, "first_frame": 7938, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49422, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580346135.069615", "responder_bytes": 151, "first_seen_epoch": "1580346135.068977" }, { "bytes": 128, "stream": 57, "flow_id": "flow-d5136e91d8f94b890ec7dca5", "packets": 2, "transport": "udp", "last_frame": 7943, "first_frame": 7942, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 49817, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1580346135.494471", "responder_bytes": 0, "first_seen_epoch": "1580346135.072144" }, { "bytes": 211, "stream": 58, "flow_id": "flow-d08e136674c6d91f843247af", "packets": 2, "transport": "udp", "last_frame": 7948, "first_frame": 7946, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 55589, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1580346136.088326", "responder_bytes": 130, "first_seen_epoch": "1580346136.075907" }, { "bytes": 10132, "stream": 81, "flow_id": "flow-65181aa631a69f2f995525fe", "packets": 29, "transport": "tcp", "last_frame": 13406, "first_frame": 7949, "initiator_ip": "10.20.30.227", "responder_ip": "13.107.3.128", "initiator_port": 49753, "responder_port": 443, "initiator_bytes": 1980, "last_seen_epoch": "1580346261.937089", "responder_bytes": 8152, "first_seen_epoch": "1580346136.091254" }, { "bytes": 1432, "stream": 59, "flow_id": "flow-ca34d8b433ad5454eaa41797", "packets": 8, "transport": "udp", "last_frame": 8047, "first_frame": 7974, "initiator_ip": "10.20.30.227", "responder_ip": "239.255.255.250", "initiator_port": 55591, "responder_port": 1900, "initiator_bytes": 1432, "last_seen_epoch": "1580346142.557724", "responder_bytes": 0, "first_seen_epoch": "1580346136.539734" }, { "bytes": 249, "stream": 60, "flow_id": "flow-e985ea69b149c7e213801fd7", "packets": 2, "transport": "udp", "last_frame": 7992, "first_frame": 7990, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 54400, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1580346140.078961", "responder_bytes": 164, "first_seen_epoch": "1580346140.078545" }, { "bytes": 259, "stream": 61, "flow_id": "flow-eaf278b782e2fe760558b560", "packets": 2, "transport": "udp", "last_frame": 7993, "first_frame": 7991, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 53116, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1580346140.079215", "responder_bytes": 169, "first_seen_epoch": "1580346140.078803" }, { "bytes": 259, "stream": 62, "flow_id": "flow-59c153b7adba451f69c65ae0", "packets": 2, "transport": "udp", "last_frame": 7996, "first_frame": 7994, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58025, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1580346140.079639", "responder_bytes": 169, "first_seen_epoch": "1580346140.079379" }, { "bytes": 235, "stream": 63, "flow_id": "flow-380a425eca7967b9df127342", "packets": 2, "transport": "udp", "last_frame": 7999, "first_frame": 7995, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49642, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1580346140.101371", "responder_bytes": 155, "first_seen_epoch": "1580346140.07944" }, { "bytes": 245, "stream": 64, "flow_id": "flow-4eb1187456f5515fa2397710", "packets": 2, "transport": "udp", "last_frame": 8000, "first_frame": 7997, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 53207, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1580346140.101541", "responder_bytes": 160, "first_seen_epoch": "1580346140.079778" }, { "bytes": 245, "stream": 65, "flow_id": "flow-b026595716dac427724d7d99", "packets": 2, "transport": "udp", "last_frame": 8001, "first_frame": 7998, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 60319, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1580346140.101886", "responder_bytes": 160, "first_seen_epoch": "1580346140.080227" }, { "bytes": 136, "stream": 66, "flow_id": "flow-ad0c52880d1b934d254f8173", "packets": 2, "transport": "udp", "last_frame": 8012, "first_frame": 8005, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 60467, "responder_port": 5355, "initiator_bytes": 136, "last_seen_epoch": "1580346140.526444", "responder_bytes": 0, "first_seen_epoch": "1580346140.104473" }, { "bytes": 146, "stream": 67, "flow_id": "flow-35b0e85c11ba0685d04aeadf", "packets": 2, "transport": "udp", "last_frame": 8014, "first_frame": 8009, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 56388, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1580346140.527631", "responder_bytes": 0, "first_seen_epoch": "1580346140.110405" }, { "bytes": 146, "stream": 68, "flow_id": "flow-7882f20c901fd122684817e7", "packets": 2, "transport": "udp", "last_frame": 8013, "first_frame": 8010, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 56132, "responder_port": 5355, "initiator_bytes": 146, "last_seen_epoch": "1580346140.527114", "responder_bytes": 0, "first_seen_epoch": "1580346140.110529" }, { "bytes": 1388, "stream": 82, "flow_id": "flow-a5da829641a59799a0889039", "packets": 12, "transport": "tcp", "last_frame": 8212, "first_frame": 8015, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49757, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1580346153.68419", "responder_bytes": 658, "first_seen_epoch": "1580346140.707297" }, { "bytes": 2072, "stream": 83, "flow_id": "flow-7b9e5548576154f730718ffa", "packets": 14, "transport": "tcp", "last_frame": 8213, "first_frame": 8022, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49758, "responder_port": 49675, "initiator_bytes": 1240, "last_seen_epoch": "1580346153.684339", "responder_bytes": 832, "first_seen_epoch": "1580346140.709627" }, { "bytes": 128, "stream": 69, "flow_id": "flow-414db04c60c5e3a6bc568554", "packets": 2, "transport": "udp", "last_frame": 8048, "first_frame": 8046, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 56902, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1580346142.952189", "responder_bytes": 0, "first_seen_epoch": "1580346142.546052" }, { "bytes": 128, "stream": 70, "flow_id": "flow-b6c31f502c33d1742399e901", "packets": 2, "transport": "udp", "last_frame": 8054, "first_frame": 8053, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 61049, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1580346144.512208", "responder_bytes": 0, "first_seen_epoch": "1580346144.096551" }, { "bytes": 10233, "stream": 84, "flow_id": "flow-a3716fbda70a230e459501c7", "packets": 28, "transport": "tcp", "last_frame": 8085, "first_frame": 8058, "initiator_ip": "10.20.30.227", "responder_ip": "204.79.197.200", "initiator_port": 49759, "responder_port": 443, "initiator_bytes": 3302, "last_seen_epoch": "1580346149.700693", "responder_bytes": 6931, "first_seen_epoch": "1580346149.612835" }, { "bytes": 213, "stream": 71, "flow_id": "flow-c080ddca2440e3652ae468a3", "packets": 2, "transport": "udp", "last_frame": 8087, "first_frame": 8086, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59097, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1580346150.991621", "responder_bytes": 140, "first_seen_epoch": "1580346150.978656" }, { "bytes": 10061, "stream": 85, "flow_id": "flow-6b274bc21ce0c70cb0de0999", "packets": 30, "transport": "tcp", "last_frame": 8205, "first_frame": 8088, "initiator_ip": "10.20.30.227", "responder_ip": "204.79.197.222", "initiator_port": 49760, "responder_port": 443, "initiator_bytes": 1977, "last_seen_epoch": "1580346153.482468", "responder_bytes": 8084, "first_seen_epoch": "1580346150.992246" }, { "bytes": 221, "stream": 72, "flow_id": "flow-844b618d9d3e895606759d05", "packets": 2, "transport": "udp", "last_frame": 8115, "first_frame": 8114, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52088, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346153.165117", "responder_bytes": 144, "first_seen_epoch": "1580346153.14728" }, { "bytes": 8077, "stream": 86, "flow_id": "flow-3d68f19e24f445deaa0d3e5e", "packets": 28, "transport": "tcp", "last_frame": 8143, "first_frame": 8116, "initiator_ip": "10.20.30.227", "responder_ip": "13.107.246.254", "initiator_port": 49761, "responder_port": 443, "initiator_bytes": 1600, "last_seen_epoch": "1580346153.254223", "responder_bytes": 6477, "first_seen_epoch": "1580346153.166215" }, { "bytes": 221, "stream": 73, "flow_id": "flow-0706b75ce33d5dc978df8f4c", "packets": 2, "transport": "udp", "last_frame": 8145, "first_frame": 8144, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 64667, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346153.280341", "responder_bytes": 144, "first_seen_epoch": "1580346153.261315" }, { "bytes": 7798, "stream": 87, "flow_id": "flow-a3984619306d909ebeacc7f4", "packets": 28, "transport": "tcp", "last_frame": 8173, "first_frame": 8146, "initiator_ip": "10.20.30.227", "responder_ip": "13.107.42.254", "initiator_port": 49762, "responder_port": 443, "initiator_bytes": 1600, "last_seen_epoch": "1580346153.362845", "responder_bytes": 6198, "first_seen_epoch": "1580346153.281373" }, { "bytes": 221, "stream": 74, "flow_id": "flow-e6e7ce48ace2049afa8593f1", "packets": 2, "transport": "udp", "last_frame": 8175, "first_frame": 8174, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59324, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346153.383388", "responder_bytes": 144, "first_seen_epoch": "1580346153.371264" }, { "bytes": 7691, "stream": 88, "flow_id": "flow-7ef098fdf80169980b683288", "packets": 26, "transport": "tcp", "last_frame": 8201, "first_frame": 8176, "initiator_ip": "10.20.30.227", "responder_ip": "204.79.197.254", "initiator_port": 49763, "responder_port": 443, "initiator_bytes": 1546, "last_seen_epoch": "1580346153.466568", "responder_bytes": 6145, "first_seen_epoch": "1580346153.384202" }, { "bytes": 156, "stream": 75, "flow_id": "flow-9da9cea524beec86b7f52aec", "packets": 2, "transport": "udp", "last_frame": 8215, "first_frame": 8214, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 62632, "responder_port": 53, "initiator_bytes": 70, "last_seen_epoch": "1580346162.725232", "responder_bytes": 86, "first_seen_epoch": "1580346162.701203" }, { "bytes": 1520, "stream": 89, "flow_id": "flow-c07600cba12e3dd43a0e60dc", "packets": 10, "transport": "tcp", "last_frame": 12862, "first_frame": 8216, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.194.46", "initiator_port": 49764, "responder_port": 80, "initiator_bytes": 772, "last_seen_epoch": "1580346252.766466", "responder_bytes": 748, "first_seen_epoch": "1580346162.726499" }, { "bytes": 394, "stream": 90, "flow_id": "flow-8cf2f14a38191fd2fb3c5160", "packets": 7, "transport": "tcp", "last_frame": 9315, "first_frame": 8217, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.194.46", "initiator_port": 49765, "responder_port": 80, "initiator_bytes": 228, "last_seen_epoch": "1580346173.063605", "responder_bytes": 166, "first_seen_epoch": "1580346162.726814" }, { "bytes": 164, "stream": 76, "flow_id": "flow-a7da01866bdba8305aeb969e", "packets": 2, "transport": "udp", "last_frame": 8226, "first_frame": 8225, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 63958, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1580346162.796395", "responder_bytes": 90, "first_seen_epoch": "1580346162.774103" }, { "bytes": 3221, "stream": 91, "flow_id": "flow-8ca0899e5d5d2add7a574b6e", "packets": 12, "transport": "tcp", "last_frame": 12832, "first_frame": 8227, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.193.132", "initiator_port": 49766, "responder_port": 80, "initiator_bytes": 1518, "last_seen_epoch": "1580346220.68718", "responder_bytes": 1703, "first_seen_epoch": "1580346162.797119" }, { "bytes": 971984, "stream": 92, "flow_id": "flow-63f4947dfb0464f94fe4a7eb", "packets": 1133, "transport": "tcp", "last_frame": 12833, "first_frame": 8234, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.193.132", "initiator_port": 49767, "responder_port": 443, "initiator_bytes": 33716, "last_seen_epoch": "1580346220.85832", "responder_bytes": 938268, "first_seen_epoch": "1580346162.847174" }, { "bytes": 166, "stream": 77, "flow_id": "flow-73b75bee20a4cfae96936ac5", "packets": 2, "transport": "udp", "last_frame": 8346, "first_frame": 8343, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 51974, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346163.292957", "responder_bytes": 91, "first_seen_epoch": "1580346163.271673" }, { "bytes": 14906, "stream": 93, "flow_id": "flow-46971e340f9cbae30281e1c4", "packets": 30, "transport": "tcp", "last_frame": 12864, "first_frame": 8347, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.194.131", "initiator_port": 49768, "responder_port": 443, "initiator_bytes": 1703, "last_seen_epoch": "1580346253.390787", "responder_bytes": 13203, "first_seen_epoch": "1580346163.293816" }, { "bytes": 206, "stream": 78, "flow_id": "flow-b427c3c33a3259128b17f908", "packets": 2, "transport": "udp", "last_frame": 8367, "first_frame": 8359, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58909, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346163.359843", "responder_bytes": 129, "first_seen_epoch": "1580346163.33589" }, { "bytes": 5768, "stream": 94, "flow_id": "flow-a16805ac229d470d9cbade62", "packets": 15, "transport": "tcp", "last_frame": 8437, "first_frame": 8370, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49769, "responder_port": 443, "initiator_bytes": 971, "last_seen_epoch": "1580346163.423321", "responder_bytes": 4797, "first_seen_epoch": "1580346163.361119" }, { "bytes": 40338, "stream": 95, "flow_id": "flow-4d9aaa67ab9cf454bd512298", "packets": 55, "transport": "tcp", "last_frame": 12866, "first_frame": 8371, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49770, "responder_port": 443, "initiator_bytes": 2124, "last_seen_epoch": "1580346253.469596", "responder_bytes": 38214, "first_seen_epoch": "1580346163.361325" }, { "bytes": 166, "stream": 79, "flow_id": "flow-aa8b3302e5988c211deb7fb4", "packets": 2, "transport": "udp", "last_frame": 8410, "first_frame": 8393, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58043, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346163.408663", "responder_bytes": 91, "first_seen_epoch": "1580346163.385566" }, { "bytes": 144250, "stream": 96, "flow_id": "flow-7cd9a23c7b58ef5a30e6c485", "packets": 155, "transport": "tcp", "last_frame": 12828, "first_frame": 8415, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.3", "initiator_port": 49771, "responder_port": 443, "initiator_bytes": 4120, "last_seen_epoch": "1580346218.608952", "responder_bytes": 140130, "first_seen_epoch": "1580346163.409634" }, { "bytes": 238, "stream": 80, "flow_id": "flow-eb6f580d99a65d2636216d59", "packets": 2, "transport": "udp", "last_frame": 8440, "first_frame": 8416, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59940, "responder_port": 53, "initiator_bytes": 78, "last_seen_epoch": "1580346163.429483", "responder_bytes": 160, "first_seen_epoch": "1580346163.410134" }, { "bytes": 9914, "stream": 97, "flow_id": "flow-a5f51ae6482fd442f14e91be", "packets": 35, "transport": "tcp", "last_frame": 13038, "first_frame": 8441, "initiator_ip": "10.20.30.227", "responder_ip": "13.107.6.158", "initiator_port": 49772, "responder_port": 443, "initiator_bytes": 2114, "last_seen_epoch": "1580346261.262085", "responder_bytes": 7800, "first_seen_epoch": "1580346163.430586" }, { "bytes": 187, "stream": 81, "flow_id": "flow-38f9ca759277945185168a95", "packets": 2, "transport": "udp", "last_frame": 8772, "first_frame": 8771, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 58640, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346163.926174", "responder_bytes": 112, "first_seen_epoch": "1580346163.901003" }, { "bytes": 61336, "stream": 98, "flow_id": "flow-996a519cf5b85294c295c140", "packets": 73, "transport": "tcp", "last_frame": 12871, "first_frame": 8773, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.1.238", "initiator_port": 49773, "responder_port": 443, "initiator_bytes": 2534, "last_seen_epoch": "1580346254.016023", "responder_bytes": 58802, "first_seen_epoch": "1580346163.928895" }, { "bytes": 185, "stream": 82, "flow_id": "flow-93fb9a4a9e1993541791899e", "packets": 2, "transport": "udp", "last_frame": 8847, "first_frame": 8791, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 54113, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1580346164.019463", "responder_bytes": 111, "first_seen_epoch": "1580346163.992029" }, { "bytes": 22398, "stream": 99, "flow_id": "flow-43a974101e4ec5d43c6626d3", "packets": 39, "transport": "tcp", "last_frame": 12873, "first_frame": 8850, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.1.238", "initiator_port": 49774, "responder_port": 443, "initiator_bytes": 2068, "last_seen_epoch": "1580346254.141693", "responder_bytes": 20330, "first_seen_epoch": "1580346164.021718" }, { "bytes": 216, "stream": 83, "flow_id": "flow-983623dc9702c3a037af2383", "packets": 2, "transport": "udp", "last_frame": 8899, "first_frame": 8893, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 51026, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1580346164.189103", "responder_bytes": 136, "first_seen_epoch": "1580346164.163758" }, { "bytes": 8645, "stream": 100, "flow_id": "flow-6e3e277ff48384cd7f20fc09", "packets": 31, "transport": "tcp", "last_frame": 12875, "first_frame": 8900, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.193.130", "initiator_port": 49775, "responder_port": 443, "initiator_bytes": 2151, "last_seen_epoch": "1580346254.453799", "responder_bytes": 6494, "first_seen_epoch": "1580346164.191242" }, { "bytes": 215, "stream": 84, "flow_id": "flow-a44af348f9bf4109ad280577", "packets": 2, "transport": "udp", "last_frame": 8924, "first_frame": 8923, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 51821, "responder_port": 53, "initiator_bytes": 87, "last_seen_epoch": "1580346164.30616", "responder_bytes": 128, "first_seen_epoch": "1580346164.28146" }, { "bytes": 8727, "stream": 101, "flow_id": "flow-9cd4ec48261cbbdacb586719", "packets": 37, "transport": "tcp", "last_frame": 12830, "first_frame": 8925, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.193.130", "initiator_port": 49776, "responder_port": 443, "initiator_bytes": 2702, "last_seen_epoch": "1580346219.577411", "responder_bytes": 6025, "first_seen_epoch": "1580346164.308805" }, { "bytes": 166, "stream": 85, "flow_id": "flow-890aef5018f8afaf4664a55c", "packets": 2, "transport": "udp", "last_frame": 8970, "first_frame": 8969, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 63140, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346164.942489", "responder_bytes": 91, "first_seen_epoch": "1580346164.921973" }, { "bytes": 8775, "stream": 102, "flow_id": "flow-ca6acfd14f5a5912debcc185", "packets": 28, "transport": "tcp", "last_frame": 12878, "first_frame": 8971, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.194.78", "initiator_port": 49777, "responder_port": 443, "initiator_bytes": 2670, "last_seen_epoch": "1580346255.031939", "responder_bytes": 6105, "first_seen_epoch": "1580346164.942978" }, { "bytes": 5930, "stream": 103, "flow_id": "flow-e4e7d410fedb55f33901668d", "packets": 18, "transport": "tcp", "last_frame": 12896, "first_frame": 9218, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49778, "responder_port": 443, "initiator_bytes": 1080, "last_seen_epoch": "1580346260.273001", "responder_bytes": 4850, "first_seen_epoch": "1580346172.19793" }, { "bytes": 215, "stream": 86, "flow_id": "flow-21199cd83b6f508200b9e51d", "packets": 2, "transport": "udp", "last_frame": 9319, "first_frame": 9313, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59491, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1580346173.078164", "responder_bytes": 130, "first_seen_epoch": "1580346173.052547" }, { "bytes": 37672, "stream": 104, "flow_id": "flow-892012b55c905733087821f5", "packets": 55, "transport": "tcp", "last_frame": 12829, "first_frame": 9320, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.1", "initiator_port": 49779, "responder_port": 443, "initiator_bytes": 2450, "last_seen_epoch": "1580346219.437253", "responder_bytes": 35222, "first_seen_epoch": "1580346173.079145" }, { "bytes": 215, "stream": 87, "flow_id": "flow-423abd69ab87571264b16896", "packets": 2, "transport": "udp", "last_frame": 9854, "first_frame": 9851, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 56909, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1580346174.305768", "responder_bytes": 130, "first_seen_epoch": "1580346174.280018" }, { "bytes": 449, "stream": 105, "flow_id": "flow-2f4edb00f8f6d715ce38a07c", "packets": 8, "transport": "tcp", "last_frame": 12895, "first_frame": 9912, "initiator_ip": "10.20.30.227", "responder_ip": "216.58.193.132", "initiator_port": 49780, "responder_port": 80, "initiator_bytes": 283, "last_seen_epoch": "1580346260.272926", "responder_bytes": 166, "first_seen_epoch": "1580346175.641704" }, { "bytes": 241, "stream": 88, "flow_id": "flow-4be6089127bf5e3d2a0b2771", "packets": 2, "transport": "udp", "last_frame": 9921, "first_frame": 9920, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 56235, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1580346175.657159", "responder_bytes": 160, "first_seen_epoch": "1580346175.656865" }, { "bytes": 227, "stream": 89, "flow_id": "flow-77c68f5033e0f3ba55931c28", "packets": 2, "transport": "udp", "last_frame": 9923, "first_frame": 9922, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 63034, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580346175.657775", "responder_bytes": 151, "first_seen_epoch": "1580346175.657584" }, { "bytes": 128, "stream": 90, "flow_id": "flow-1eb86eafc2f8001e640e4022", "packets": 2, "transport": "udp", "last_frame": 10606, "first_frame": 9926, "initiator_ip": "10.20.30.227", "responder_ip": "224.0.0.252", "initiator_port": 60640, "responder_port": 5355, "initiator_bytes": 128, "last_seen_epoch": "1580346176.082359", "responder_bytes": 0, "first_seen_epoch": "1580346175.658982" }, { "bytes": 277, "stream": 91, "flow_id": "flow-362fbd5a44639f7cbf9d6876", "packets": 2, "transport": "udp", "last_frame": 9941, "first_frame": 9929, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 61313, "responder_port": 53, "initiator_bytes": 89, "last_seen_epoch": "1580346175.8244", "responder_bytes": 188, "first_seen_epoch": "1580346175.766263" }, { "bytes": 18331, "stream": 106, "flow_id": "flow-f23e16e0aee248840cc22525", "packets": 28, "transport": "tcp", "last_frame": 12886, "first_frame": 9942, "initiator_ip": "10.20.30.227", "responder_ip": "198.185.159.144", "initiator_port": 49781, "responder_port": 80, "initiator_bytes": 3100, "last_seen_epoch": "1580346260.261316", "responder_bytes": 15231, "first_seen_epoch": "1580346175.82597" }, { "bytes": 1859, "stream": 107, "flow_id": "flow-22bbc10b26c4659c375c9520", "packets": 12, "transport": "tcp", "last_frame": 12884, "first_frame": 9943, "initiator_ip": "10.20.30.227", "responder_ip": "198.185.159.144", "initiator_port": 49782, "responder_port": 80, "initiator_bytes": 946, "last_seen_epoch": "1580346260.261064", "responder_bytes": 913, "first_seen_epoch": "1580346175.826359" }, { "bytes": 240, "stream": 92, "flow_id": "flow-c9a8ef1f2e338f5fdd5696c0", "packets": 2, "transport": "udp", "last_frame": 9967, "first_frame": 9964, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 64267, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346175.990586", "responder_bytes": 165, "first_seen_epoch": "1580346175.976792" }, { "bytes": 268, "stream": 93, "flow_id": "flow-bf415c49e64d81c50a0971d3", "packets": 2, "transport": "udp", "last_frame": 9969, "first_frame": 9965, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57045, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1580346175.996891", "responder_bytes": 186, "first_seen_epoch": "1580346175.977669" }, { "bytes": 275, "stream": 94, "flow_id": "flow-91680f7d7c8594cc8ea60ac0", "packets": 2, "transport": "udp", "last_frame": 9980, "first_frame": 9966, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52117, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1580346176.008872", "responder_bytes": 192, "first_seen_epoch": "1580346175.979322" }, { "bytes": 9474, "stream": 108, "flow_id": "flow-a2527d79f9e1f10bac76a40e", "packets": 15, "transport": "tcp", "last_frame": 12839, "first_frame": 9968, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49783, "responder_port": 80, "initiator_bytes": 1126, "last_seen_epoch": "1580346221.061641", "responder_bytes": 8348, "first_seen_epoch": "1580346175.991446" }, { "bytes": 444926, "stream": 109, "flow_id": "flow-70448e60a882c857158f2224", "packets": 358, "transport": "tcp", "last_frame": 12841, "first_frame": 9970, "initiator_ip": "10.20.30.227", "responder_ip": "104.97.213.249", "initiator_port": 49784, "responder_port": 80, "initiator_bytes": 3604, "last_seen_epoch": "1580346221.10904", "responder_bytes": 441322, "first_seen_epoch": "1580346175.997589" }, { "bytes": 16848, "stream": 110, "flow_id": "flow-d274279990eeec9079f7698b", "packets": 18, "transport": "tcp", "last_frame": 12835, "first_frame": 9971, "initiator_ip": "10.20.30.227", "responder_ip": "104.97.213.249", "initiator_port": 49785, "responder_port": 80, "initiator_bytes": 747, "last_seen_epoch": "1580346221.030985", "responder_bytes": 16101, "first_seen_epoch": "1580346175.997793" }, { "bytes": 3593, "stream": 111, "flow_id": "flow-82a1a5e0a61147c46da1ae24", "packets": 9, "transport": "tcp", "last_frame": 12834, "first_frame": 9972, "initiator_ip": "10.20.30.227", "responder_ip": "104.97.213.249", "initiator_port": 49786, "responder_port": 80, "initiator_bytes": 718, "last_seen_epoch": "1580346221.030901", "responder_bytes": 2875, "first_seen_epoch": "1580346175.997969" }, { "bytes": 358256, "stream": 112, "flow_id": "flow-fedf93df51f950cd7743de20", "packets": 282, "transport": "tcp", "last_frame": 12840, "first_frame": 9973, "initiator_ip": "10.20.30.227", "responder_ip": "104.97.213.249", "initiator_port": 49787, "responder_port": 80, "initiator_bytes": 2742, "last_seen_epoch": "1580346221.093101", "responder_bytes": 355514, "first_seen_epoch": "1580346175.998137" }, { "bytes": 176, "stream": 95, "flow_id": "flow-6b5a65cd623edde77ac33d81", "packets": 2, "transport": "udp", "last_frame": 9979, "first_frame": 9978, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49795, "responder_port": 53, "initiator_bytes": 80, "last_seen_epoch": "1580346176.008821", "responder_bytes": 96, "first_seen_epoch": "1580346176.007568" }, { "bytes": 3860, "stream": 113, "flow_id": "flow-6160bde8342a10fdb57d7260", "packets": 12, "transport": "tcp", "last_frame": 13496, "first_frame": 9981, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.170", "initiator_port": 49788, "responder_port": 80, "initiator_bytes": 1192, "last_seen_epoch": "1580346262.103976", "responder_bytes": 2668, "first_seen_epoch": "1580346176.010041" }, { "bytes": 62463, "stream": 114, "flow_id": "flow-ba96c68a7c69bad58b0b4db4", "packets": 55, "transport": "tcp", "last_frame": 12838, "first_frame": 9982, "initiator_ip": "10.20.30.227", "responder_ip": "151.101.0.238", "initiator_port": 49789, "responder_port": 80, "initiator_bytes": 1171, "last_seen_epoch": "1580346221.061597", "responder_bytes": 61292, "first_seen_epoch": "1580346176.010364" }, { "bytes": 9429, "stream": 115, "flow_id": "flow-f7c6cafb22dc7f480a223f17", "packets": 28, "transport": "tcp", "last_frame": 12842, "first_frame": 9984, "initiator_ip": "10.20.30.227", "responder_ip": "151.101.0.238", "initiator_port": 49790, "responder_port": 443, "initiator_bytes": 2064, "last_seen_epoch": "1580346221.921147", "responder_bytes": 7365, "first_seen_epoch": "1580346176.0106" }, { "bytes": 1721, "stream": 116, "flow_id": "flow-5c28b421a3ac52d47344c110", "packets": 8, "transport": "tcp", "last_frame": 12836, "first_frame": 9986, "initiator_ip": "10.20.30.227", "responder_ip": "151.101.0.238", "initiator_port": 49791, "responder_port": 80, "initiator_bytes": 749, "last_seen_epoch": "1580346221.061452", "responder_bytes": 972, "first_seen_epoch": "1580346176.010985" }, { "bytes": 25906, "stream": 117, "flow_id": "flow-7b73f6ab98faa4082cd7c801", "packets": 29, "transport": "tcp", "last_frame": 12843, "first_frame": 10509, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49792, "responder_port": 80, "initiator_bytes": 1000, "last_seen_epoch": "1580346221.952679", "responder_bytes": 24906, "first_seen_epoch": "1580346176.07252" }, { "bytes": 276, "stream": 96, "flow_id": "flow-deac932faaef55a845b43781", "packets": 2, "transport": "udp", "last_frame": 10703, "first_frame": 10702, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 60128, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1580346176.092439", "responder_bytes": 190, "first_seen_epoch": "1580346176.092083" }, { "bytes": 2282878, "stream": 118, "flow_id": "flow-3ded3a314a32d42b80b71415", "packets": 1770, "transport": "tcp", "last_frame": 12847, "first_frame": 10747, "initiator_ip": "10.20.30.227", "responder_ip": "151.101.0.238", "initiator_port": 49793, "responder_port": 443, "initiator_bytes": 16755, "last_seen_epoch": "1580346222.53078", "responder_bytes": 2266123, "first_seen_epoch": "1580346176.128298" }, { "bytes": 166, "stream": 97, "flow_id": "flow-8e679d735971a99b26e52ae3", "packets": 2, "transport": "udp", "last_frame": 11088, "first_frame": 11075, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 55584, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346176.92326", "responder_bytes": 91, "first_seen_epoch": "1580346176.900362" }, { "bytes": 197, "stream": 98, "flow_id": "flow-7c186a9d07df03aa54fef897", "packets": 2, "transport": "udp", "last_frame": 11079, "first_frame": 11076, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 59038, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580346176.916963", "responder_bytes": 121, "first_seen_epoch": "1580346176.900868" }, { "bytes": 7314, "stream": 119, "flow_id": "flow-7ed747498e9bd5ce828cf6fe", "packets": 17, "transport": "tcp", "last_frame": 11410, "first_frame": 11083, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49794, "responder_port": 443, "initiator_bytes": 1041, "last_seen_epoch": "1580346176.993465", "responder_bytes": 6273, "first_seen_epoch": "1580346176.919553" }, { "bytes": 25363, "stream": 120, "flow_id": "flow-135b76f51d1075bc644d1a0e", "packets": 28, "transport": "tcp", "last_frame": 12844, "first_frame": 11084, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49795, "responder_port": 80, "initiator_bytes": 950, "last_seen_epoch": "1580346221.968851", "responder_bytes": 24413, "first_seen_epoch": "1580346176.920035" }, { "bytes": 41400, "stream": 121, "flow_id": "flow-155a9429f6a58d8887f6eac1", "packets": 44, "transport": "tcp", "last_frame": 13502, "first_frame": 11085, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49796, "responder_port": 80, "initiator_bytes": 1623, "last_seen_epoch": "1580346262.105428", "responder_bytes": 39777, "first_seen_epoch": "1580346176.920393" }, { "bytes": 7314, "stream": 122, "flow_id": "flow-12e46387a3ff1e0f8eb5004b", "packets": 17, "transport": "tcp", "last_frame": 11407, "first_frame": 11086, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49797, "responder_port": 443, "initiator_bytes": 1041, "last_seen_epoch": "1580346176.992704", "responder_bytes": 6273, "first_seen_epoch": "1580346176.921492" }, { "bytes": 96582, "stream": 123, "flow_id": "flow-ec5cb4b5c3dc322660d46f1c", "packets": 104, "transport": "tcp", "last_frame": 12826, "first_frame": 11087, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49798, "responder_port": 443, "initiator_bytes": 2915, "last_seen_epoch": "1580346217.033373", "responder_bytes": 93667, "first_seen_epoch": "1580346176.922318" }, { "bytes": 7314, "stream": 124, "flow_id": "flow-00c57894ecdd3c7df73c952d", "packets": 17, "transport": "tcp", "last_frame": 11412, "first_frame": 11089, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49799, "responder_port": 443, "initiator_bytes": 1041, "last_seen_epoch": "1580346176.994666", "responder_bytes": 6273, "first_seen_epoch": "1580346176.924027" }, { "bytes": 7314, "stream": 125, "flow_id": "flow-29e3d664ebb7beb66a83a9db", "packets": 17, "transport": "tcp", "last_frame": 11414, "first_frame": 11090, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49800, "responder_port": 443, "initiator_bytes": 1041, "last_seen_epoch": "1580346176.995683", "responder_bytes": 6273, "first_seen_epoch": "1580346176.924713" }, { "bytes": 214, "stream": 99, "flow_id": "flow-b305920d0d6d4165882e5382", "packets": 2, "transport": "udp", "last_frame": 11217, "first_frame": 11140, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 55769, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346176.960653", "responder_bytes": 137, "first_seen_epoch": "1580346176.940784" }, { "bytes": 237, "stream": 100, "flow_id": "flow-7a884ffc7635cf6948479076", "packets": 2, "transport": "udp", "last_frame": 12034, "first_frame": 12029, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 50760, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1580346177.17977", "responder_bytes": 164, "first_seen_epoch": "1580346177.160264" }, { "bytes": 9680, "stream": 126, "flow_id": "flow-20d1a9b7e59579ef19c85894", "packets": 23, "transport": "tcp", "last_frame": 13010, "first_frame": 12035, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49801, "responder_port": 443, "initiator_bytes": 2429, "last_seen_epoch": "1580346261.226034", "responder_bytes": 7251, "first_seen_epoch": "1580346177.181045" }, { "bytes": 979, "stream": 127, "flow_id": "flow-260998129441745648b33e30", "packets": 7, "transport": "tcp", "last_frame": 12858, "first_frame": 12852, "initiator_ip": "10.20.30.227", "responder_ip": "81.177.6.156", "initiator_port": 49802, "responder_port": 80, "initiator_bytes": 610, "last_seen_epoch": "1580346246.47542", "responder_bytes": 369, "first_seen_epoch": "1580346246.09754" }, { "bytes": 860, "stream": 101, "flow_id": "flow-570f50d476a15fa66f52cb69", "packets": 4, "transport": "udp", "last_frame": 12880, "first_frame": 12867, "initiator_ip": "10.20.30.227", "responder_ip": "239.255.255.250", "initiator_port": 50763, "responder_port": 1900, "initiator_bytes": 860, "last_seen_epoch": "1580346256.499874", "responder_bytes": 0, "first_seen_epoch": "1580346253.474549" }, { "bytes": 18647, "stream": 128, "flow_id": "flow-d6011dfc930d16b53f95a5cf", "packets": 29, "transport": "tcp", "last_frame": 13045, "first_frame": 12889, "initiator_ip": "10.20.30.227", "responder_ip": "198.185.159.144", "initiator_port": 49803, "responder_port": 80, "initiator_bytes": 5165, "last_seen_epoch": "1580346261.297288", "responder_bytes": 13482, "first_seen_epoch": "1580346260.261721" }, { "bytes": 5620, "stream": 129, "flow_id": "flow-2d0e6e31223a877f570dbe57", "packets": 16, "transport": "tcp", "last_frame": 12982, "first_frame": 12890, "initiator_ip": "10.20.30.227", "responder_ip": "198.185.159.144", "initiator_port": 49804, "responder_port": 80, "initiator_bytes": 4771, "last_seen_epoch": "1580346261.183978", "responder_bytes": 849, "first_seen_epoch": "1580346260.268318" }, { "bytes": 240, "stream": 102, "flow_id": "flow-0975e8940bfac101460a8228", "packets": 2, "transport": "udp", "last_frame": 12897, "first_frame": 12891, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 63269, "responder_port": 53, "initiator_bytes": 75, "last_seen_epoch": "1580346260.282579", "responder_bytes": 165, "first_seen_epoch": "1580346260.269585" }, { "bytes": 275, "stream": 103, "flow_id": "flow-37ca4e1cd78fbca8eccdde48", "packets": 2, "transport": "udp", "last_frame": 12899, "first_frame": 12892, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 50857, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1580346260.300132", "responder_bytes": 192, "first_seen_epoch": "1580346260.272017" }, { "bytes": 268, "stream": 104, "flow_id": "flow-7b4a0ea762b986d8a4473a6d", "packets": 2, "transport": "udp", "last_frame": 12918, "first_frame": 12898, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 60623, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1580346260.328782", "responder_bytes": 186, "first_seen_epoch": "1580346260.299235" }, { "bytes": 7206, "stream": 130, "flow_id": "flow-38bbd8a5dde5afcb270f0edb", "packets": 15, "transport": "tcp", "last_frame": 12949, "first_frame": 12900, "initiator_ip": "10.20.30.227", "responder_ip": "104.81.85.107", "initiator_port": 49805, "responder_port": 443, "initiator_bytes": 987, "last_seen_epoch": "1580346260.386218", "responder_bytes": 6219, "first_seen_epoch": "1580346260.303352" }, { "bytes": 206, "stream": 105, "flow_id": "flow-e8ff49d7d774940515314fe8", "packets": 2, "transport": "udp", "last_frame": 12919, "first_frame": 12901, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 51563, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346260.328844", "responder_bytes": 129, "first_seen_epoch": "1580346260.303439" }, { "bytes": 178, "stream": 131, "flow_id": "flow-eadde04a25584a9110449450", "packets": 3, "transport": "tcp", "last_frame": 12930, "first_frame": 12920, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.14.163", "initiator_port": 49806, "responder_port": 80, "initiator_bytes": 120, "last_seen_epoch": "1580346260.342261", "responder_bytes": 58, "first_seen_epoch": "1580346260.330141" }, { "bytes": 2168, "stream": 132, "flow_id": "flow-ef1314932782eca95ecb33a3", "packets": 8, "transport": "tcp", "last_frame": 12993, "first_frame": 12944, "initiator_ip": "10.20.30.227", "responder_ip": "198.185.159.144", "initiator_port": 49807, "responder_port": 80, "initiator_bytes": 1341, "last_seen_epoch": "1580346261.219708", "responder_bytes": 827, "first_seen_epoch": "1580346260.365763" }, { "bytes": 1690, "stream": 133, "flow_id": "flow-014a4849a46d0bb36629fab0", "packets": 7, "transport": "tcp", "last_frame": 13039, "first_frame": 12964, "initiator_ip": "10.20.30.227", "responder_ip": "198.185.159.144", "initiator_port": 49808, "responder_port": 80, "initiator_bytes": 886, "last_seen_epoch": "1580346261.273174", "responder_bytes": 804, "first_seen_epoch": "1580346261.136069" }, { "bytes": 214, "stream": 106, "flow_id": "flow-1b9dd69431ba6430b2189c1a", "packets": 2, "transport": "udp", "last_frame": 12975, "first_frame": 12965, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 57554, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1580346261.180031", "responder_bytes": 137, "first_seen_epoch": "1580346261.149966" }, { "bytes": 197, "stream": 107, "flow_id": "flow-50d013e6402754b07714788b", "packets": 2, "transport": "udp", "last_frame": 12974, "first_frame": 12966, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 49163, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580346261.179938", "responder_bytes": 121, "first_seen_epoch": "1580346261.150453" }, { "bytes": 174, "stream": 108, "flow_id": "flow-c5da434d9d20120d82045c79", "packets": 2, "transport": "udp", "last_frame": 12984, "first_frame": 12971, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 52066, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1580346261.193361", "responder_bytes": 95, "first_seen_epoch": "1580346261.170645" }, { "bytes": 76464, "stream": 134, "flow_id": "flow-1fd2d3df01740837147319dd", "packets": 79, "transport": "tcp", "last_frame": 13396, "first_frame": 12985, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.170", "initiator_port": 49809, "responder_port": 80, "initiator_bytes": 2794, "last_seen_epoch": "1580346261.656762", "responder_bytes": 73670, "first_seen_epoch": "1580346261.194396" }, { "bytes": 74579, "stream": 135, "flow_id": "flow-c6d59608c440bc3185937816", "packets": 80, "transport": "tcp", "last_frame": 13402, "first_frame": 13040, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.170", "initiator_port": 49810, "responder_port": 80, "initiator_bytes": 3420, "last_seen_epoch": "1580346261.680188", "responder_bytes": 71159, "first_seen_epoch": "1580346261.292405" }, { "bytes": 17783, "stream": 136, "flow_id": "flow-32a72e2e3f96ee38339a62ea", "packets": 21, "transport": "tcp", "last_frame": 13391, "first_frame": 13041, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.170", "initiator_port": 49811, "responder_port": 80, "initiator_bytes": 1413, "last_seen_epoch": "1580346261.647157", "responder_bytes": 16370, "first_seen_epoch": "1580346261.292826" }, { "bytes": 87610, "stream": 137, "flow_id": "flow-428ff8a67b909d48eeecf170", "packets": 95, "transport": "tcp", "last_frame": 13469, "first_frame": 13044, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.170", "initiator_port": 49812, "responder_port": 80, "initiator_bytes": 4343, "last_seen_epoch": "1580346262.028001", "responder_bytes": 83267, "first_seen_epoch": "1580346261.293365" }, { "bytes": 168, "stream": 109, "flow_id": "flow-efa8bec83b962e9de30b9d44", "packets": 2, "transport": "udp", "last_frame": 13185, "first_frame": 13171, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 64804, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1580346261.489516", "responder_bytes": 92, "first_seen_epoch": "1580346261.466624" }, { "bytes": 174, "stream": 110, "flow_id": "flow-eadcda70847e9a18ab07e6f0", "packets": 2, "transport": "udp", "last_frame": 13193, "first_frame": 13183, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 61729, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1580346261.515653", "responder_bytes": 95, "first_seen_epoch": "1580346261.486853" }, { "bytes": 174, "stream": 111, "flow_id": "flow-e5e9758411159dc51c49b0fe", "packets": 2, "transport": "udp", "last_frame": 13194, "first_frame": 13184, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 50601, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1580346261.515711", "responder_bytes": 95, "first_seen_epoch": "1580346261.487034" }, { "bytes": 2462, "stream": 138, "flow_id": "flow-3c825e415841507ea8720b1e", "packets": 10, "transport": "tcp", "last_frame": 13381, "first_frame": 13186, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.2.227", "initiator_port": 49813, "responder_port": 80, "initiator_bytes": 1091, "last_seen_epoch": "1580346261.624983", "responder_bytes": 1371, "first_seen_epoch": "1580346261.491338" }, { "bytes": 21396, "stream": 139, "flow_id": "flow-77a6d61d082be5c2ca428034", "packets": 23, "transport": "tcp", "last_frame": 13301, "first_frame": 13195, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.2.238", "initiator_port": 49814, "responder_port": 80, "initiator_bytes": 806, "last_seen_epoch": "1580346261.553224", "responder_bytes": 20590, "first_seen_epoch": "1580346261.516493" }, { "bytes": 24537, "stream": 140, "flow_id": "flow-eb2cbf9f04d38cdb4f0af322", "packets": 26, "transport": "tcp", "last_frame": 13338, "first_frame": 13196, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.2.238", "initiator_port": 49815, "responder_port": 80, "initiator_bytes": 860, "last_seen_epoch": "1580346261.56228", "responder_bytes": 23677, "first_seen_epoch": "1580346261.516685" }, { "bytes": 23401, "stream": 141, "flow_id": "flow-74d1bbbec282addbed079333", "packets": 27, "transport": "tcp", "last_frame": 13337, "first_frame": 13197, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.12.46", "initiator_port": 49816, "responder_port": 80, "initiator_bytes": 914, "last_seen_epoch": "1580346261.562236", "responder_bytes": 22487, "first_seen_epoch": "1580346261.517102" }, { "bytes": 26036, "stream": 142, "flow_id": "flow-4938effe6b1a025393b17092", "packets": 29, "transport": "tcp", "last_frame": 13371, "first_frame": 13198, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.12.46", "initiator_port": 49817, "responder_port": 80, "initiator_bytes": 968, "last_seen_epoch": "1580346261.603123", "responder_bytes": 25068, "first_seen_epoch": "1580346261.517304" }, { "bytes": 25191, "stream": 143, "flow_id": "flow-2fab926c8af958dab4713876", "packets": 29, "transport": "tcp", "last_frame": 13370, "first_frame": 13199, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.12.46", "initiator_port": 49818, "responder_port": 80, "initiator_bytes": 968, "last_seen_epoch": "1580346261.60302", "responder_bytes": 24223, "first_seen_epoch": "1580346261.517607" }, { "bytes": 18874, "stream": 144, "flow_id": "flow-c3eea0594164b84578528827", "packets": 20, "transport": "tcp", "last_frame": 13358, "first_frame": 13200, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.12.46", "initiator_port": 49819, "responder_port": 80, "initiator_bytes": 698, "last_seen_epoch": "1580346261.579966", "responder_bytes": 18176, "first_seen_epoch": "1580346261.517802" }, { "bytes": 4667, "stream": 145, "flow_id": "flow-5abfcdfe143e7d849a315cf5", "packets": 12, "transport": "tcp", "last_frame": 13482, "first_frame": 13339, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.2.227", "initiator_port": 49820, "responder_port": 80, "initiator_bytes": 1175, "last_seen_epoch": "1580346262.088602", "responder_bytes": 3492, "first_seen_epoch": "1580346261.56645" }, { "bytes": 6894, "stream": 146, "flow_id": "flow-0dd2ef7d475d75ada412e521", "packets": 17, "transport": "tcp", "last_frame": 13504, "first_frame": 13368, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.170", "initiator_port": 49821, "responder_port": 80, "initiator_bytes": 2282, "last_seen_epoch": "1580346262.149261", "responder_bytes": 4612, "first_seen_epoch": "1580346261.601344" }, { "bytes": 2135, "stream": 147, "flow_id": "flow-3f0dcf866a7f6f918a2bf3d9", "packets": 7, "transport": "tcp", "last_frame": 13404, "first_frame": 13369, "initiator_ip": "10.20.30.227", "responder_ip": "172.217.9.170", "initiator_port": 49822, "responder_port": 80, "initiator_bytes": 924, "last_seen_epoch": "1580346261.7", "responder_bytes": 1211, "first_seen_epoch": "1580346261.601746" }, { "bytes": 164, "stream": 112, "flow_id": "flow-068561cc76bb60ab3686c8a9", "packets": 2, "transport": "udp", "last_frame": 13479, "first_frame": 13473, "initiator_ip": "10.20.30.227", "responder_ip": "10.20.30.2", "initiator_port": 62364, "responder_port": 53, "initiator_bytes": 74, "last_seen_epoch": "1580346262.083115", "responder_bytes": 90, "first_seen_epoch": "1580346262.060835" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-01a52c508876d137301ea123", "src_port": 58262, "tcp_stream": null, "udp_stream": 1, "frame_number": 3, "timestamp_epoch": "1580345692.505473000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58262, "event_id": "evt-21a542fd2dcc8ad27d30f5b2", "src_port": 53, "tcp_stream": null, "udp_stream": 1, "frame_number": 4, "timestamp_epoch": "1580345692.506101000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-a5076890b09ca8fc614ca0af", "src_port": 59510, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1580345692.611709000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59510, "event_id": "evt-9e70b14c743f673d2fac3063", "src_port": 53, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1580345692.612130000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-5529ce59211cc0353c0bb265", "src_port": 59575, "tcp_stream": null, "udp_stream": 7, "frame_number": 157, "timestamp_epoch": "1580345692.876379000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59575, "event_id": "evt-a2ffed704c54915da7f4a01a", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 158, "timestamp_epoch": "1580345692.876703000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-4bb9032124c8ded8960317b8", "src_port": 58111, "tcp_stream": null, "udp_stream": 9, "frame_number": 172, "timestamp_epoch": "1580345693.006207000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58111, "event_id": "evt-8a15f2a074d134ffe9d0591d", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 173, "timestamp_epoch": "1580345693.006461000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-1fb50e6df14e033622b76b6e", "src_port": 57103, "tcp_stream": null, "udp_stream": 11, "frame_number": 185, "timestamp_epoch": "1580345693.209115000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 57103, "event_id": "evt-ca42c65edd57027029ef8a59", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 186, "timestamp_epoch": "1580345693.209304000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "Sol-Lightnet-DC.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-0c4895095db322845863c4fe", "src_port": 53811, "tcp_stream": null, "udp_stream": 13, "frame_number": 276, "timestamp_epoch": "1580345693.606109000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "Sol-Lightnet-DC.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 53811, "event_id": "evt-021e0842bc7384d31f30c0b2", "src_port": 53, "tcp_stream": null, "udp_stream": 13, "frame_number": 277, "timestamp_epoch": "1580345693.606441000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "DESKTOP-4C02EMG.sol-lightnet.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-d9b154352881840194f80404", "src_port": 51314, "tcp_stream": null, "udp_stream": 14, "frame_number": 478, "timestamp_epoch": "1580345694.867230000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "DESKTOP-4C02EMG.sol-lightnet.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 51314, "event_id": "evt-4e7497fda9107110b1875080", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 479, "timestamp_epoch": "1580345694.867451000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.a": "10.20.30.227", "dns.qry.name": "sol-lightnet.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-c47053eb33aa286a72882b9b", "src_port": 57221, "tcp_stream": null, "udp_stream": 15, "frame_number": 480, "timestamp_epoch": "1580345694.868990000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.227", "dns.qry.name": "sol-lightnet.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 57221, "event_id": "evt-70cae4f3dfe94a87dd9870b2", "src_port": 53, "tcp_stream": null, "udp_stream": 15, "frame_number": 481, "timestamp_epoch": "1580345694.870229000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-30e69c4dacdf80205db6a67e", "src_port": 57433, "tcp_stream": null, "udp_stream": 16, "frame_number": 483, "timestamp_epoch": "1580345695.240525000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "23.51.186.146", "dns.cname": "go.microsoft.com.edgekey.net,e11290.dspg.akamaiedge.net", "dns.qry.name": "go.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 57433, "event_id": "evt-a56daea6acb11d6b296f8101", "src_port": 53, "tcp_stream": null, "udp_stream": 16, "frame_number": 484, "timestamp_epoch": "1580345695.260860000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "dmd.metaservices.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3f59bc6113644b0f262d59cf", "src_port": 59248, "tcp_stream": null, "udp_stream": 17, "frame_number": 499, "timestamp_epoch": "1580345695.381660000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "40.67.249.61", "dns.cname": "devicemetadataservice.trafficmanager.net,vmss-prod-neu.northeurope.cloudapp.azure.com", "dns.qry.name": "dmd.metaservices.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59248, "event_id": "evt-25f6827e9b0ab33648a3bac0", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 500, "timestamp_epoch": "1580345695.400755000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-dafb76445f6cf96f0c25188d", "src_port": 52243, "tcp_stream": null, "udp_stream": 18, "frame_number": 512, "timestamp_epoch": "1580345695.800643000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 52243, "event_id": "evt-052359d0c3a3bd529ec545f3", "src_port": 53, "tcp_stream": null, "udp_stream": 18, "frame_number": 513, "timestamp_epoch": "1580345695.800856000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-a9198b50c22f9f11795c7f38", "src_port": 58118, "tcp_stream": null, "udp_stream": 26, "frame_number": 729, "timestamp_epoch": "1580345703.914322000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "52.114.75.79", "dns.cname": "self.events.data.onecollector.akadns.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58118, "event_id": "evt-10445976129d91d029bfa5fc", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 730, "timestamp_epoch": "1580345703.932605000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "SOL-LIGHTNET.COM", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ab608956afe91faa39c65718", "src_port": 56134, "tcp_stream": null, "udp_stream": 27, "frame_number": 763, "timestamp_epoch": "1580345703.983963000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "SOL-LIGHTNET.COM", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 56134, "event_id": "evt-2c5b00f610e74b883c27ce36", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 764, "timestamp_epoch": "1580345703.984249000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ddd5d6b860747cc3a6ee620e", "src_port": 61279, "tcp_stream": null, "udp_stream": 28, "frame_number": 936, "timestamp_epoch": "1580345705.324217000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "52.242.211.89", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 61279, "event_id": "evt-08553bdc027ec8ff1b1cb2dc", "src_port": 53, "tcp_stream": null, "udp_stream": 28, "frame_number": 937, "timestamp_epoch": "1580345705.530620000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-bae451b0d117ff6af4323f28", "src_port": 64462, "tcp_stream": null, "udp_stream": 29, "frame_number": 965, "timestamp_epoch": "1580345706.619144000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 64462, "event_id": "evt-6eacb0efd5ee04825b4ea5be", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 966, "timestamp_epoch": "1580345706.619407000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3c216223e6da8b45ed14a071", "src_port": 59353, "tcp_stream": null, "udp_stream": 30, "frame_number": 967, "timestamp_epoch": "1580345706.619777000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59353, "event_id": "evt-1aa56eca643dec3db582c2ed", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 968, "timestamp_epoch": "1580345706.619934000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-089fb4a22036efe73fd0ed0a", "src_port": 57099, "tcp_stream": null, "udp_stream": 31, "frame_number": 969, "timestamp_epoch": "1580345708.560332000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 57099, "event_id": "evt-700389f176743931d9fbf4de", "src_port": 53, "tcp_stream": null, "udp_stream": 31, "frame_number": 970, "timestamp_epoch": "1580345708.579100000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-d631aa364672004ea24cbe0f", "src_port": 53429, "tcp_stream": null, "udp_stream": 32, "frame_number": 1122, "timestamp_epoch": "1580345751.490053000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "40.126.0.67,40.126.0.66,40.126.0.69,40.126.0.68,40.126.0.72,40.126.0.73,40.126.0.70,40.126.0.74", "dns.cname": "prda.aadg.msidentity.com,www.tm.a.prd.aadg.akadns.net", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 53429, "event_id": "evt-54b1bac4c0b134c3da3fed06", "src_port": 53, "tcp_stream": null, "udp_stream": 32, "frame_number": 1123, "timestamp_epoch": "1580345751.503989000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ea23608cd405ad19af256a37", "src_port": 52094, "tcp_stream": null, "udp_stream": 33, "frame_number": 1145, "timestamp_epoch": "1580345753.344667000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 52094, "event_id": "evt-c9ac215a78f60ba748e27ca0", "src_port": 53, "tcp_stream": null, "udp_stream": 33, "frame_number": 1146, "timestamp_epoch": "1580345753.345199000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "gengrasjeepram.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-61e6025380c563c31c5eaf2a", "src_port": 56177, "tcp_stream": null, "udp_stream": 35, "frame_number": 1164, "timestamp_epoch": "1580345757.280076000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "49.51.133.162", "dns.qry.name": "gengrasjeepram.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 56177, "event_id": "evt-adc06529118f9ab5f2f4e995", "src_port": 53, "tcp_stream": null, "udp_stream": 35, "frame_number": 1165, "timestamp_epoch": "1580345757.512836000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "api.ipify.org", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-8aa9db383fd365eafbefaba2", "src_port": 49446, "tcp_stream": null, "udp_stream": 36, "frame_number": 1237, "timestamp_epoch": "1580345758.330226000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "184.73.165.106,23.21.50.37,54.243.147.226,174.129.223.190,54.235.203.7,23.21.59.179,184.73.201.169,54.235.220.229", "dns.cname": "nagano-19599.herokussl.com,elb097307-934924932.us-east-1.elb.amazonaws.com", "dns.qry.name": "api.ipify.org", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 49446, "event_id": "evt-3414975d4a44da83600479f5", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 1238, "timestamp_epoch": "1580345758.355581000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "twereptale.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-38ce55e5b417b758aee4e907", "src_port": 53286, "tcp_stream": null, "udp_stream": 37, "frame_number": 1246, "timestamp_epoch": "1580345758.460647000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "81.177.6.156", "dns.qry.name": "twereptale.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 53286, "event_id": "evt-d61bd507dd62cf12363f77d2", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 1247, "timestamp_epoch": "1580345758.668788000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "xolightfinance.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-5081f4cbf5e660178eb06cc1", "src_port": 63575, "tcp_stream": null, "udp_stream": 38, "frame_number": 1255, "timestamp_epoch": "1580345759.048081000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "148.66.137.40", "dns.qry.name": "xolightfinance.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 63575, "event_id": "evt-40b0446ab3d58908afe51d38", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 1256, "timestamp_epoch": "1580345759.142249000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "twereptale.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-f908548eee3246a6ed0be6a7", "src_port": 59675, "tcp_stream": null, "udp_stream": 39, "frame_number": 1308, "timestamp_epoch": "1580345760.481660000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "81.177.6.156", "dns.qry.name": "twereptale.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59675, "event_id": "evt-318ae41902ab5393ef135d4c", "src_port": 53, "tcp_stream": null, "udp_stream": 39, "frame_number": 1309, "timestamp_epoch": "1580345760.482013000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-8e14dbe6a124563fa6a596b5", "src_port": 51244, "tcp_stream": null, "udp_stream": 40, "frame_number": 1327, "timestamp_epoch": "1580345761.053095000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "52.114.132.22", "dns.cname": "self.events.data.onecollector.akadns.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 51244, "event_id": "evt-01bb21c9e92415e98207ff56", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 1356, "timestamp_epoch": "1580345761.097005000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-062248f18a2fbdfcdfa9f56d", "src_port": 64131, "tcp_stream": null, "udp_stream": 41, "frame_number": 3466, "timestamp_epoch": "1580345764.847758000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "52.242.211.89", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 64131, "event_id": "evt-f5156d51ccda10eceacab68a", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 3467, "timestamp_epoch": "1580345764.848131000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-fbcd3fc86a6c0c9298def03b", "src_port": 50762, "tcp_stream": null, "udp_stream": 42, "frame_number": 3473, "timestamp_epoch": "1580345764.891393000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 50762, "event_id": "evt-67aecf48519bc79faa3a5a0f", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 3474, "timestamp_epoch": "1580345764.891800000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-05cf9ba82b2147a3ba340a26", "src_port": 59127, "tcp_stream": null, "udp_stream": 44, "frame_number": 4573, "timestamp_epoch": "1580345766.626268000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59127, "event_id": "evt-dac7196c50c78d79ecf391a6", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 4575, "timestamp_epoch": "1580345766.626816000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-e9c998eb60a0a21920a908f1", "src_port": 63165, "tcp_stream": null, "udp_stream": 45, "frame_number": 4577, "timestamp_epoch": "1580345766.627729000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 63165, "event_id": "evt-ca09cae6cae42fc7a20e99c5", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 4578, "timestamp_epoch": "1580345766.628153000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-5e4e97d27a885739036543ad", "src_port": 56347, "tcp_stream": null, "udp_stream": 46, "frame_number": 7671, "timestamp_epoch": "1580345870.794640000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "13.107.246.10", "dns.cname": "sfd-production.azurefd.net,t-0001.t-msedge.net,Edge-Prod-DALr3.ctrl.t-0001.t-msedge.net,standard.t-0001.t-msedge.net", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 56347, "event_id": "evt-51ae8ba3e98c998534792dbd", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 7672, "timestamp_epoch": "1580345870.814698000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-0a9edf2f9252d4fd3fd5318b", "src_port": 50355, "tcp_stream": null, "udp_stream": 47, "frame_number": 7723, "timestamp_epoch": "1580345984.277983000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "52.109.76.30", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 50355, "event_id": "evt-5c77bc2b17db2a1d73a80dde", "src_port": 53, "tcp_stream": null, "udp_stream": 47, "frame_number": 7724, "timestamp_epoch": "1580345984.336546000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-41b4bda5d212380d6b90c991", "src_port": 54317, "tcp_stream": null, "udp_stream": 48, "frame_number": 7745, "timestamp_epoch": "1580345993.866175000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "10.20.30.2", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.sol-lightnet.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 54317, "event_id": "evt-f6b779a004da16601dddb431", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 7746, "timestamp_epoch": "1580345993.866483000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-9df867b0479ebf20f7e88bcb", "src_port": 61977, "tcp_stream": null, "udp_stream": 50, "frame_number": 7920, "timestamp_epoch": "1580346133.530307000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 61977, "event_id": "evt-061288e6abafec558bd03d63", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 7921, "timestamp_epoch": "1580346133.530794000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-d2a6fcba9c0546b13125bafc", "src_port": 54996, "tcp_stream": null, "udp_stream": 51, "frame_number": 7922, "timestamp_epoch": "1580346133.532618000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 54996, "event_id": "evt-3b01a3c3157f00efe3db74c4", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 7923, "timestamp_epoch": "1580346133.532959000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-7b2b78cdad76bdb9f8dbfe12", "src_port": 55340, "tcp_stream": null, "udp_stream": 55, "frame_number": 7936, "timestamp_epoch": "1580346135.067261000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 55340, "event_id": "evt-1240d6945d930b8cc0f04554", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 7937, "timestamp_epoch": "1580346135.067724000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-e350a0c19e0ce2796fa88af7", "src_port": 49422, "tcp_stream": null, "udp_stream": 56, "frame_number": 7938, "timestamp_epoch": "1580346135.068977000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 49422, "event_id": "evt-6003550856ef827c8242c65f", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 7939, "timestamp_epoch": "1580346135.069615000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-5c09d5ce1c8a9c7f92ba3f50", "src_port": 55589, "tcp_stream": null, "udp_stream": 58, "frame_number": 7946, "timestamp_epoch": "1580346136.075907000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "13.107.3.128", "dns.cname": "s-0001.s-msedge.net", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 55589, "event_id": "evt-a23170889c74cc824638a590", "src_port": 53, "tcp_stream": null, "udp_stream": 58, "frame_number": 7948, "timestamp_epoch": "1580346136.088326000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "novvslyn.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-1b8bcce5a665558c5fa0f559", "src_port": 54400, "tcp_stream": null, "udp_stream": 60, "frame_number": 7990, "timestamp_epoch": "1580346140.078545000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "srjnzgvklqxna.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-1ef3dfa8e6734d215136a2a3", "src_port": 53116, "tcp_stream": null, "udp_stream": 61, "frame_number": 7991, "timestamp_epoch": "1580346140.078803000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "novvslyn.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 54400, "event_id": "evt-6a3de0d3a9bb7fc150797650", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 7992, "timestamp_epoch": "1580346140.078961000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "srjnzgvklqxna.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 53116, "event_id": "evt-2f315df9d509f01980560ad4", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 7993, "timestamp_epoch": "1580346140.079215000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "zpckjikzgjvck.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ef89b4cfcda8357a8f48a31c", "src_port": 58025, "tcp_stream": null, "udp_stream": 62, "frame_number": 7994, "timestamp_epoch": "1580346140.079379000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "novvslyn.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-07e60e7741ed22aff8fe6e91", "src_port": 49642, "tcp_stream": null, "udp_stream": 63, "frame_number": 7995, "timestamp_epoch": "1580346140.079440000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "zpckjikzgjvck.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58025, "event_id": "evt-d551ee80269951b47bfe034a", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 7996, "timestamp_epoch": "1580346140.079639000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "srjnzgvklqxna.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-c1f7060440dedd4fe183463c", "src_port": 53207, "tcp_stream": null, "udp_stream": 64, "frame_number": 7997, "timestamp_epoch": "1580346140.079778000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "zpckjikzgjvck.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-cd168a27d44c505c166e17e7", "src_port": 60319, "tcp_stream": null, "udp_stream": 65, "frame_number": 7998, "timestamp_epoch": "1580346140.080227000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "novvslyn.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 49642, "event_id": "evt-5b2162d6b52081ffb0f2471b", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 7999, "timestamp_epoch": "1580346140.101371000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "srjnzgvklqxna.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 53207, "event_id": "evt-676756075f885a29616d04c8", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 8000, "timestamp_epoch": "1580346140.101541000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "zpckjikzgjvck.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 60319, "event_id": "evt-64243048e0b0790110b2f4ba", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 8001, "timestamp_epoch": "1580346140.101886000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-689ed23163d39c523713fa6c", "src_port": 59097, "tcp_stream": null, "udp_stream": 71, "frame_number": 8086, "timestamp_epoch": "1580346150.978656000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "204.79.197.222", "dns.cname": "1.perf.msedge.net,a-0019.a-msedge.net", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59097, "event_id": "evt-51a32ec133c735a4daab3a3f", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 8087, "timestamp_epoch": "1580346150.991621000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3282bb9c76b2328e7ce4c7f6", "src_port": 52088, "tcp_stream": null, "udp_stream": 72, "frame_number": 8114, "timestamp_epoch": "1580346153.147280000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "13.107.246.254", "dns.cname": "t-ring.t-9999.t-msedge.net,t-9999.t-msedge.net", "dns.qry.name": "t-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 52088, "event_id": "evt-60d6fbee16440fd9352fb794", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 8115, "timestamp_epoch": "1580346153.165117000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "l-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-e66efe240ec4d7d431eb484b", "src_port": 64667, "tcp_stream": null, "udp_stream": 73, "frame_number": 8144, "timestamp_epoch": "1580346153.261315000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "13.107.42.254", "dns.cname": "l-ring.l-9999.l-msedge.net,l-9999.l-msedge.net", "dns.qry.name": "l-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 64667, "event_id": "evt-e5f2ed8a2752df037dff7417", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 8145, "timestamp_epoch": "1580346153.280341000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-f4619ac24073d3482977f9e7", "src_port": 59324, "tcp_stream": null, "udp_stream": 74, "frame_number": 8174, "timestamp_epoch": "1580346153.371264000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "204.79.197.254", "dns.cname": "a-ring.a-9999.a-msedge.net,a-9999.a-msedge.net", "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59324, "event_id": "evt-a45a3042170f3d9e91f576fd", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 8175, "timestamp_epoch": "1580346153.383388000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-80b8dff811b36d819e0a80d6", "src_port": 62632, "tcp_stream": null, "udp_stream": 75, "frame_number": 8214, "timestamp_epoch": "1580346162.701203000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.194.46", "dns.qry.name": "google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 62632, "event_id": "evt-865febbd123343d406f1e565", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 8215, "timestamp_epoch": "1580346162.725232000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-6443784c2bb794a3a02eb794", "src_port": 63958, "tcp_stream": null, "udp_stream": 76, "frame_number": 8225, "timestamp_epoch": "1580346162.774103000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.193.132", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 63958, "event_id": "evt-985b024440d20784b09b28d9", "src_port": 53, "tcp_stream": null, "udp_stream": 76, "frame_number": 8226, "timestamp_epoch": "1580346162.796395000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "ssl.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-59a3b5016a54bff32890da34", "src_port": 51974, "tcp_stream": null, "udp_stream": 77, "frame_number": 8343, "timestamp_epoch": "1580346163.271673000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.194.131", "dns.qry.name": "ssl.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 51974, "event_id": "evt-3aaeb7817a7b2fac46a428c9", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 8346, "timestamp_epoch": "1580346163.292957000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3cb55e0b303ebd8224d8040b", "src_port": 58909, "tcp_stream": null, "udp_stream": 78, "frame_number": 8359, "timestamp_epoch": "1580346163.335890000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.14.163", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58909, "event_id": "evt-5148fa8484128332f0090e3c", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 8367, "timestamp_epoch": "1580346163.359843000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-f1312d6568f8e988eedf4356", "src_port": 58043, "tcp_stream": null, "udp_stream": 79, "frame_number": 8393, "timestamp_epoch": "1580346163.385566000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.9.3", "dns.qry.name": "www.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58043, "event_id": "evt-e2d2535a75a9806d5a257eaf", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 8410, "timestamp_epoch": "1580346163.408663000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ce3b706c14a023b7f6087c13", "src_port": 59940, "tcp_stream": null, "udp_stream": 80, "frame_number": 8416, "timestamp_epoch": "1580346163.410134000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "13.107.6.158", "dns.cname": "edge-microsoft-com.b-0005.b-msedge.net,b-0005.b-msedge.net", "dns.qry.name": "edge.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59940, "event_id": "evt-cc36741f5b0341b736d182a3", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 8440, "timestamp_epoch": "1580346163.429483000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-1cab6dc94eb0d341b5dec9c9", "src_port": 58640, "tcp_stream": null, "udp_stream": 81, "frame_number": 8771, "timestamp_epoch": "1580346163.901003000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.1.238", "dns.cname": "plus.l.google.com", "dns.qry.name": "apis.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 58640, "event_id": "evt-ba8d4cbdbeff98defea62262", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 8772, "timestamp_epoch": "1580346163.926174000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "ogs.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-8276ce6f3c2d42861a08bddc", "src_port": 54113, "tcp_stream": null, "udp_stream": 82, "frame_number": 8791, "timestamp_epoch": "1580346163.992029000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.1.238", "dns.cname": "www3.l.google.com", "dns.qry.name": "ogs.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 54113, "event_id": "evt-b0e60709def0ec808e77a4cc", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 8847, "timestamp_epoch": "1580346164.019463000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-cdbeeb712c0ca98851135e5d", "src_port": 51026, "tcp_stream": null, "udp_stream": 83, "frame_number": 8893, "timestamp_epoch": "1580346164.163758000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.193.130", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "adservice.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 51026, "event_id": "evt-664e7bf69a9d1ab0923a2f28", "src_port": 53, "tcp_stream": null, "udp_stream": 83, "frame_number": 8899, "timestamp_epoch": "1580346164.189103000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-4849f44675e317308721b2fe", "src_port": 51821, "tcp_stream": null, "udp_stream": 84, "frame_number": 8923, "timestamp_epoch": "1580346164.281460000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.193.130", "dns.cname": "pagead46.l.doubleclick.net", "dns.qry.name": "googleads.g.doubleclick.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 51821, "event_id": "evt-9110d57eada145d558b02342", "src_port": 53, "tcp_stream": null, "udp_stream": 84, "frame_number": 8924, "timestamp_epoch": "1580346164.306160000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "play.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-b71fdd8433a2b2b5edd0da33", "src_port": 63140, "tcp_stream": null, "udp_stream": 85, "frame_number": 8969, "timestamp_epoch": "1580346164.921973000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.194.78", "dns.qry.name": "play.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 63140, "event_id": "evt-e5a76524005b043ea5d06b84", "src_port": 53, "tcp_stream": null, "udp_stream": 85, "frame_number": 8970, "timestamp_epoch": "1580346164.942489000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "lh5.googleusercontent.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-05edc7fb9628762219e8e077", "src_port": 59491, "tcp_stream": null, "udp_stream": 86, "frame_number": 9313, "timestamp_epoch": "1580346173.052547000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.9.1", "dns.cname": "googlehosted.l.googleusercontent.com", "dns.qry.name": "lh5.googleusercontent.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59491, "event_id": "evt-57fb37e96c6fcc75928d83b2", "src_port": 53, "tcp_stream": null, "udp_stream": 86, "frame_number": 9319, "timestamp_epoch": "1580346173.078164000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "lh4.googleusercontent.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-02415dc38e77936aea963bc5", "src_port": 56909, "tcp_stream": null, "udp_stream": 87, "frame_number": 9851, "timestamp_epoch": "1580346174.280018000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.9.1", "dns.cname": "googlehosted.l.googleusercontent.com", "dns.qry.name": "lh4.googleusercontent.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 56909, "event_id": "evt-b68d353002f42f12c9c73a20", "src_port": 53, "tcp_stream": null, "udp_stream": 87, "frame_number": 9854, "timestamp_epoch": "1580346174.305768000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-87518eb72cd73eb0db2b2dc8", "src_port": 56235, "tcp_stream": null, "udp_stream": 88, "frame_number": 9920, "timestamp_epoch": "1580346175.656865000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.sol-lightnet.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 56235, "event_id": "evt-e9db5bc4769d1c4ce92feb76", "src_port": 53, "tcp_stream": null, "udp_stream": 88, "frame_number": 9921, "timestamp_epoch": "1580346175.657159000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-b7399a2af43c6659bcd19c5d", "src_port": 63034, "tcp_stream": null, "udp_stream": 89, "frame_number": 9922, "timestamp_epoch": "1580346175.657584000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 63034, "event_id": "evt-bb5745cbb3018949134ce8ae", "src_port": 53, "tcp_stream": null, "udp_stream": 89, "frame_number": 9923, "timestamp_epoch": "1580346175.657775000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.tippingpointhampstead.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-50de7785066d77cbfdaf6d65", "src_port": 61313, "tcp_stream": null, "udp_stream": 91, "frame_number": 9929, "timestamp_epoch": "1580346175.766263000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "198.185.159.144,198.185.159.145,198.49.23.144,198.49.23.145", "dns.cname": "ext-cust.squarespace.com", "dns.qry.name": "www.tippingpointhampstead.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 61313, "event_id": "evt-2cd5f608601e82b4bc84794a", "src_port": 53, "tcp_stream": null, "udp_stream": 91, "frame_number": 9941, "timestamp_epoch": "1580346175.824400000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-6aec5a65ebc040ab59bd78b3", "src_port": 64267, "tcp_stream": null, "udp_stream": 92, "frame_number": 9964, "timestamp_epoch": "1580346175.976792000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "assets.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-30206f7c4fefb3198a21e0f4", "src_port": 57045, "tcp_stream": null, "udp_stream": 93, "frame_number": 9965, "timestamp_epoch": "1580346175.977669000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "static1.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-16e28c04d1495fcbc9affe30", "src_port": 52117, "tcp_stream": null, "udp_stream": 94, "frame_number": 9966, "timestamp_epoch": "1580346175.979322000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "104.81.85.107", "dns.cname": "use.typekit.net-v3.edgekey.net,e6653.f.akamaiedge.net", "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 64267, "event_id": "evt-58d5351ac55445243751bd31", "src_port": 53, "tcp_stream": null, "udp_stream": 92, "frame_number": 9967, "timestamp_epoch": "1580346175.990586000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "104.97.213.249", "dns.cname": "static3.squarespace.com-1.edgekey.net,e16901.dscb.akamaiedge.net", "dns.qry.name": "assets.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 57045, "event_id": "evt-658ee9b71441739e870af127", "src_port": 53, "tcp_stream": null, "udp_stream": 93, "frame_number": 9969, "timestamp_epoch": "1580346175.996891000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ac1f0c128b131f6f79a5263c", "src_port": 49795, "tcp_stream": null, "udp_stream": 95, "frame_number": 9978, "timestamp_epoch": "1580346176.007568000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.14.170", "dns.qry.name": "fonts.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 49795, "event_id": "evt-ed75acb99ee629224d2cb0ed", "src_port": 53, "tcp_stream": null, "udp_stream": 95, "frame_number": 9979, "timestamp_epoch": "1580346176.008821000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "151.101.0.238,151.101.64.238,151.101.128.238,151.101.192.238", "dns.cname": "prod.squarespace.map.fastly.net", "dns.qry.name": "static1.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 52117, "event_id": "evt-a66c6a1730a0e7742ce146f3", "src_port": 53, "tcp_stream": null, "udp_stream": 94, "frame_number": 9980, "timestamp_epoch": "1580346176.008872000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "images.squarespace-cdn.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-360342bb412930db2c812c5e", "src_port": 60128, "tcp_stream": null, "udp_stream": 96, "frame_number": 10702, "timestamp_epoch": "1580346176.092083000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "151.101.64.238,151.101.128.238,151.101.192.238,151.101.0.238", "dns.cname": "squarespace.map.fastly.net", "dns.qry.name": "images.squarespace-cdn.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 60128, "event_id": "evt-1a2a5b9b8a9d176481b0c4aa", "src_port": 53, "tcp_stream": null, "udp_stream": 96, "frame_number": 10703, "timestamp_epoch": "1580346176.092439000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "maps.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-8cfb7b841b3ac494e1353728", "src_port": 55584, "tcp_stream": null, "udp_stream": 97, "frame_number": 11075, "timestamp_epoch": "1580346176.900362000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3afb8810ddff5cf890c06fd4", "src_port": 59038, "tcp_stream": null, "udp_stream": 98, "frame_number": 11076, "timestamp_epoch": "1580346176.900868000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "31.13.93.35", "dns.cname": "star-mini.c10r.facebook.com", "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 59038, "event_id": "evt-9a04ae2e1b836da1d9e7761b", "src_port": 53, "tcp_stream": null, "udp_stream": 98, "frame_number": 11079, "timestamp_epoch": "1580346176.916963000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.194.78", "dns.qry.name": "maps.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 55584, "event_id": "evt-fe26201ef7089333f73a8fb1", "src_port": 53, "tcp_stream": null, "udp_stream": 97, "frame_number": 11088, "timestamp_epoch": "1580346176.923260000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.instagram.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-2631fb40c1f6af5f4618137a", "src_port": 55769, "tcp_stream": null, "udp_stream": 99, "frame_number": 11140, "timestamp_epoch": "1580346176.940784000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "31.13.93.174", "dns.cname": "z-p42-instagram.c10r.facebook.com", "dns.qry.name": "www.instagram.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 55769, "event_id": "evt-39698fa8da689effc752a126", "src_port": 53, "tcp_stream": null, "udp_stream": 99, "frame_number": 11217, "timestamp_epoch": "1580346176.960653000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "p.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-6ec345c68a9af359c52e060b", "src_port": 50760, "tcp_stream": null, "udp_stream": 100, "frame_number": 12029, "timestamp_epoch": "1580346177.160264000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "104.81.85.107", "dns.cname": "p.typekit.net-v3.edgekey.net,e6653.dscf.akamaiedge.net", "dns.qry.name": "p.typekit.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 50760, "event_id": "evt-c1e4af976b4bb5fc082bfed5", "src_port": 53, "tcp_stream": null, "udp_stream": 100, "frame_number": 12034, "timestamp_epoch": "1580346177.179770000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3ae1df53e12cfe7fa671ed22", "src_port": 63269, "tcp_stream": null, "udp_stream": 102, "frame_number": 12891, "timestamp_epoch": "1580346260.269585000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "static1.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-5adf089875c6e19686c2b65d", "src_port": 50857, "tcp_stream": null, "udp_stream": 103, "frame_number": 12892, "timestamp_epoch": "1580346260.272017000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "104.81.85.107", "dns.cname": "use.typekit.net-v3.edgekey.net,e6653.f.akamaiedge.net", "dns.qry.name": "use.typekit.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 63269, "event_id": "evt-df6d8d092874974eccc79c3b", "src_port": 53, "tcp_stream": null, "udp_stream": 102, "frame_number": 12897, "timestamp_epoch": "1580346260.282579000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "assets.squarespace.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-0dbc5ef0d27910cb168153b4", "src_port": 60623, "tcp_stream": null, "udp_stream": 104, "frame_number": 12898, "timestamp_epoch": "1580346260.299235000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "151.101.0.238,151.101.64.238,151.101.128.238,151.101.192.238", "dns.cname": "prod.squarespace.map.fastly.net", "dns.qry.name": "static1.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 50857, "event_id": "evt-631381b4c07b3b776073f5d9", "src_port": 53, "tcp_stream": null, "udp_stream": 103, "frame_number": 12899, "timestamp_epoch": "1580346260.300132000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-064fc9b319e3c635eb26dd61", "src_port": 51563, "tcp_stream": null, "udp_stream": 105, "frame_number": 12901, "timestamp_epoch": "1580346260.303439000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "104.97.213.249", "dns.cname": "static3.squarespace.com-1.edgekey.net,e16901.dscb.akamaiedge.net", "dns.qry.name": "assets.squarespace.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 60623, "event_id": "evt-b306e7ea8522bb4cf3d9e379", "src_port": 53, "tcp_stream": null, "udp_stream": 104, "frame_number": 12918, "timestamp_epoch": "1580346260.328782000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.14.163", "dns.cname": "gstaticadssl.l.google.com", "dns.qry.name": "fonts.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 51563, "event_id": "evt-e4823ef1f64c139d3eeeef9d", "src_port": 53, "tcp_stream": null, "udp_stream": 105, "frame_number": 12919, "timestamp_epoch": "1580346260.328844000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.instagram.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-3e7486c9ac7999596837eb5d", "src_port": 57554, "tcp_stream": null, "udp_stream": 106, "frame_number": 12965, "timestamp_epoch": "1580346261.149966000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-27e269f4be9cd9558cab5712", "src_port": 49163, "tcp_stream": null, "udp_stream": 107, "frame_number": 12966, "timestamp_epoch": "1580346261.150453000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "maps.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-cd7e8c3765baea82a11af068", "src_port": 52066, "tcp_stream": null, "udp_stream": 108, "frame_number": 12971, "timestamp_epoch": "1580346261.170645000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "31.13.93.35", "dns.cname": "star-mini.c10r.facebook.com", "dns.qry.name": "www.facebook.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 49163, "event_id": "evt-f604f46db8573248f4aa7f2d", "src_port": 53, "tcp_stream": null, "udp_stream": 107, "frame_number": 12974, "timestamp_epoch": "1580346261.179938000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "31.13.93.174", "dns.cname": "z-p42-instagram.c10r.facebook.com", "dns.qry.name": "www.instagram.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 57554, "event_id": "evt-31e04bfa57784485f19aaeb4", "src_port": 53, "tcp_stream": null, "udp_stream": 106, "frame_number": 12975, "timestamp_epoch": "1580346261.180031000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.9.170", "dns.qry.name": "maps.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 52066, "event_id": "evt-e01d9b80c899d43c5e5937d6", "src_port": 53, "tcp_stream": null, "udp_stream": 108, "frame_number": 12984, "timestamp_epoch": "1580346261.193361000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "maps.gstatic.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-64b4ee3c01a6747e97793e09", "src_port": 64804, "tcp_stream": null, "udp_stream": 109, "frame_number": 13171, "timestamp_epoch": "1580346261.466624000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "khm0.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-dcff5ed2379238ab42ac764d", "src_port": 61729, "tcp_stream": null, "udp_stream": 110, "frame_number": 13183, "timestamp_epoch": "1580346261.486853000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "khm1.googleapis.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-ae360fca879558edfe11e6b6", "src_port": 50601, "tcp_stream": null, "udp_stream": 111, "frame_number": 13184, "timestamp_epoch": "1580346261.487034000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.2.227", "dns.qry.name": "maps.gstatic.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 64804, "event_id": "evt-40ddf4bddbb2bf2b1e027119", "src_port": 53, "tcp_stream": null, "udp_stream": 109, "frame_number": 13185, "timestamp_epoch": "1580346261.489516000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.2.238", "dns.qry.name": "khm0.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 61729, "event_id": "evt-789c2b9c7ecfe7960ef8fab1", "src_port": 53, "tcp_stream": null, "udp_stream": 110, "frame_number": 13193, "timestamp_epoch": "1580346261.515653000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "172.217.12.46", "dns.qry.name": "khm1.googleapis.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 50601, "event_id": "evt-59c93106fc0be7cc1c569aee", "src_port": 53, "tcp_stream": null, "udp_stream": 111, "frame_number": 13194, "timestamp_epoch": "1580346261.515711000" }, { "kind": "dns", "dst_ip": "10.20.30.2", "fields": { "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": 53, "event_id": "evt-2c388564d9604241a164df5d", "src_port": 62364, "tcp_stream": null, "udp_stream": 112, "frame_number": 13473, "timestamp_epoch": "1580346262.060835000" }, { "kind": "dns", "dst_ip": "10.20.30.227", "fields": { "dns.a": "216.58.193.132", "dns.qry.name": "www.google.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "10.20.30.2", "dst_port": 62364, "event_id": "evt-243c9f3d756297d02aa1aec6", "src_port": 53, "tcp_stream": null, "udp_stream": 112, "frame_number": 13479, "timestamp_epoch": "1580346262.083115000" } ], "dhcp": [], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a6cbfa6235c19ce0c64b5c02", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1580345692.299272000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5cfe35852fc98e913c149c25", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 2, "timestamp_epoch": "1580345692.299344000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-4c02emg$" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7aabd5bbbbd233d2cede1922", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 18, "timestamp_epoch": "1580345692.775911000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "30" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-45003155a4d4cc6fb3da7846", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 19, "timestamp_epoch": "1580345692.777262000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-4c02emg$" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7df22901d6934b10d48f731c", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 46, "timestamp_epoch": "1580345692.804319000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-af4c148b9397f6d098ddfc3d", "src_port": null, "tcp_stream": 3, "udp_stream": null, "frame_number": 48, "timestamp_epoch": "1580345692.805580000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-4c02emg$" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0a8d877431a88b7e177e38e1", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 66, "timestamp_epoch": "1580345692.824226000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "30" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-acce0530d4523366cf83bdef", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 67, "timestamp_epoch": "1580345692.824792000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-573074f8a3040785d051829b", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 75, "timestamp_epoch": "1580345692.830504000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-303a407d3659dde1b8e742a9", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 78, "timestamp_epoch": "1580345692.831884000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-4c02emg$" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-751b9f11b893dde1c4323068", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 86, "timestamp_epoch": "1580345692.838290000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4ad502ea40d2ee5b2df9c14a", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 88, "timestamp_epoch": "1580345692.840021000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0526b8c39d74e0113af14ef3", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 99, "timestamp_epoch": "1580345692.846799000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0b77b577b2bd5393ca6a849c", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 105, "timestamp_epoch": "1580345692.847794000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e611797137533b94f6efe86e", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 114, "timestamp_epoch": "1580345692.848631000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1aff1509322ca84b85435046", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 117, "timestamp_epoch": "1580345692.848856000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8592275e49ed7ecb176ed2ba", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 120, "timestamp_epoch": "1580345692.849912000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5827ec948f86ba59b8fe7362", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 121, "timestamp_epoch": "1580345692.850208000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-aa10d3d42fa381854d7a2436", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 127, "timestamp_epoch": "1580345692.850973000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f9622cb2e9e331c6c46c1184", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 131, "timestamp_epoch": "1580345692.853814000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-987e37c2acbd22572ad503e5", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 132, "timestamp_epoch": "1580345692.854212000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-86774e8840e155ca02b932c2", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1580345692.861742000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-9509673290a4c9a596d5d2ff", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 148, "timestamp_epoch": "1580345692.863037000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-165d976e0d1829b7e87e07b0", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 149, "timestamp_epoch": "1580345692.863770000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-6ac190c84493cc04492beece", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 193, "timestamp_epoch": "1580345693.235861000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e7c38d205a67951fa336bdc1", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 194, "timestamp_epoch": "1580345693.236196000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-967146a2c8c96468fe965c95", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 195, "timestamp_epoch": "1580345693.236523000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4b343794e9e7ba762f7e5e8d", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 201, "timestamp_epoch": "1580345693.251970000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-eded79505115f4489a671171", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 204, "timestamp_epoch": "1580345693.252877000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c65e947bc6334b530f3130ee", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 213, "timestamp_epoch": "1580345693.253632000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1a857a0710562bb957e6f31a", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 216, "timestamp_epoch": "1580345693.254021000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-cff1423ce698097cd06661f4", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 223, "timestamp_epoch": "1580345693.254417000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f6e5982f2c45ef5027b542ad", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 225, "timestamp_epoch": "1580345693.255923000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-61da3a8b8c63572b7536a6cf", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 226, "timestamp_epoch": "1580345693.256379000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3e2fcefd7c88a009e548528d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 227, "timestamp_epoch": "1580345693.256578000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a8dae5098c90fe3d91d1f2a3", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 228, "timestamp_epoch": "1580345693.256672000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3b7a882c4d8313dc5b164571", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 229, "timestamp_epoch": "1580345693.257199000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-099a3c7da56cd951247a82a1", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 230, "timestamp_epoch": "1580345693.271494000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ca3b99c7cdef69e91f6e0237", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 231, "timestamp_epoch": "1580345693.272135000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-882d71db0e321d771e99d4f0", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 255, "timestamp_epoch": "1580345693.330831000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5ca4ae0645aefac01a4092c9", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 256, "timestamp_epoch": "1580345693.331166000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-87a4772324f318a97c7d41d6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 261, "timestamp_epoch": "1580345693.508361000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7da65aacfb4e1710f9bd7b2d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 263, "timestamp_epoch": "1580345693.508923000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f05ccb0ef00ad3e5fabcc92a", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 264, "timestamp_epoch": "1580345693.509254000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e9a733bb1aa0635f5f42aad6", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 278, "timestamp_epoch": "1580345693.715894000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-33fccb24e85bafe20f2ceff0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 279, "timestamp_epoch": "1580345693.800923000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-456b9acb62a5fd0d9e159d12", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 280, "timestamp_epoch": "1580345693.800990000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-51a7f69acb391a6de954f33c", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 289, "timestamp_epoch": "1580345694.046060000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-cb7a06888c4e3147761f2579", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1580345694.046938000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f73709cf083e6c6e8569c51a", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 297, "timestamp_epoch": "1580345694.076514000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f7fd1782f975fe23786c55c8", "src_port": null, "tcp_stream": 19, "udp_stream": null, "frame_number": 300, "timestamp_epoch": "1580345694.077734000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2a1d1de020a204139687d0c6", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 311, "timestamp_epoch": "1580345694.104168000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-df1b86abdf5427fb7d867c3b", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 313, "timestamp_epoch": "1580345694.104991000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-966901c4e8cef8825d910331", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 325, "timestamp_epoch": "1580345694.135663000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4f62de569a44d07ffdfeaaaf", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 328, "timestamp_epoch": "1580345694.137019000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b13db0957f01ab9a745ba7da", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 337, "timestamp_epoch": "1580345694.137739000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-49f1d0fa7e67932a981166a8", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 340, "timestamp_epoch": "1580345694.138014000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-86a41f346e2c598e17ea89a7", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 347, "timestamp_epoch": "1580345694.138573000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-23bf81a5a8769eaacc6d8272", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 349, "timestamp_epoch": "1580345694.140317000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a891e4629994feaa40a430fd", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 350, "timestamp_epoch": "1580345694.140685000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a3a9856e53b5041de69626bf", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 351, "timestamp_epoch": "1580345694.140882000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8c7f5d96c3d46a331731fe68", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 353, "timestamp_epoch": "1580345694.161588000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-61ab5e97a76eb96af1bc143d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 354, "timestamp_epoch": "1580345694.162032000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4da4298c51a5934cf4245c71", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1580345694.171877000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-17f9477ca2f8508271500c79", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 356, "timestamp_epoch": "1580345694.172119000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-85d606702ebfbd1a358e98cf", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1580345694.178930000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4fa0b07122e1d7407f90c91c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1580345694.179253000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6154453b7993a3cc1c2813cf", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1580345694.188295000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ad4a9201e31391655cef1df9", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1580345694.188920000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-93c288214473d2e2a9a6c33e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1580345694.189281000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-11e1d85703d67991974da373", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1580345694.189462000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-62014afdc4cbcb4efca36d6c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1580345694.189630000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b2c9c90561a962dbf2f39fd4", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 364, "timestamp_epoch": "1580345694.189959000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e6a8ef0d904d635dcfd1ea2d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 365, "timestamp_epoch": "1580345694.190604000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-48b25c839af4053ed347d29a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 366, "timestamp_epoch": "1580345694.190886000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-453a21183f828d1cd53e5957", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 367, "timestamp_epoch": "1580345694.191265000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-718ef2516f64cb6b7aecd020", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 368, "timestamp_epoch": "1580345694.191425000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-29cb5cfeb8719abcdfd73204", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 369, "timestamp_epoch": "1580345694.192470000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3bc37ad4ba0ac5a760a38b33", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 370, "timestamp_epoch": "1580345694.192684000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-355a7ed0b024294d3a4f7256", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 371, "timestamp_epoch": "1580345694.194601000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0839d152e94ece3e80d12f3a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 372, "timestamp_epoch": "1580345694.195046000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2f32eaf2fd3ada7bafc7b7fd", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1580345694.201853000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-82bfda06075177c8acd6432c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 374, "timestamp_epoch": "1580345694.202115000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-541744ebe007fe97d9a7b530", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 375, "timestamp_epoch": "1580345694.204822000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-602c7b818ec273f03e428185", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 376, "timestamp_epoch": "1580345694.205183000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6cf8c3e093d69a08b07e64e3", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 377, "timestamp_epoch": "1580345694.206665000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-353c07b67d9008071694177d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 378, "timestamp_epoch": "1580345694.207175000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-08dbdde7afe31ba91a91d1ee", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 379, "timestamp_epoch": "1580345694.209836000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7896242289e0e97359ca6b2a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 380, "timestamp_epoch": "1580345694.210049000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e071a19f648dd6c65faed0fe", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 381, "timestamp_epoch": "1580345694.218679000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e1f60ad6ec2c28fd03de2634", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 382, "timestamp_epoch": "1580345694.219130000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-bc126c9fa77b1ce0680a8f2e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 383, "timestamp_epoch": "1580345694.235821000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4d2fcf23266c8d5e27b498bd", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 384, "timestamp_epoch": "1580345694.236515000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4614e55abc40912bac1ac843", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1580345694.244356000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-cf7c7e8be2d6367b6e44098e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 386, "timestamp_epoch": "1580345694.244639000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0174cfb6864955719e41ffc2", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 387, "timestamp_epoch": "1580345694.289005000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bf73662632499cf1566b7e5e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 388, "timestamp_epoch": "1580345694.289350000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0b3e06362f0e271e4f580a20", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 389, "timestamp_epoch": "1580345694.311397000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b25ede606cc0914bfe4dbc52", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 390, "timestamp_epoch": "1580345694.311942000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-763723e7c030e1efac98e18d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 391, "timestamp_epoch": "1580345694.312797000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4e60ff6d0766f73c8a3b53da", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 392, "timestamp_epoch": "1580345694.312949000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-aeabc53f3939ec5d1e8f1c39", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 393, "timestamp_epoch": "1580345694.316166000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1aad12ad2c4fbf9e538f4174", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1580345694.316360000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d0579626e4207ce25d05e076", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 395, "timestamp_epoch": "1580345694.316780000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-41aa2d63a8add4fa37e66143", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 396, "timestamp_epoch": "1580345694.316928000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c024a836f458f26cfec32caf", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 397, "timestamp_epoch": "1580345694.317115000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-90bd22fc4967ee20d3339a4f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 398, "timestamp_epoch": "1580345694.317267000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e471f8660f205fb37a9b9622", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 399, "timestamp_epoch": "1580345694.317433000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bbfa5ab4699302ae9c3d7711", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 400, "timestamp_epoch": "1580345694.317570000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2fb6e051297f84d23029c1c3", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 401, "timestamp_epoch": "1580345694.319358000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f9d8a970e6fff4c7fb868d52", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 402, "timestamp_epoch": "1580345694.319573000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-48c10ab5895d5005c9e43a7f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 403, "timestamp_epoch": "1580345694.320806000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e16c33710ae5ec93ee338129", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 404, "timestamp_epoch": "1580345694.321034000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-07c6837eceb9d291d37550f7", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 405, "timestamp_epoch": "1580345694.321695000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-2c938d33e1d25246732771dc", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 406, "timestamp_epoch": "1580345694.322278000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2a26b865b9dc9fe3a2729a4b", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 407, "timestamp_epoch": "1580345694.322839000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ecff72c64a245f4fe0055399", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 408, "timestamp_epoch": "1580345694.323214000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-56f7258db9a602a75dfb3562", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 409, "timestamp_epoch": "1580345694.323591000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-353749473c8026aa301f4a03", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 410, "timestamp_epoch": "1580345694.323900000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-75993a889da17f690f68fe7a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 411, "timestamp_epoch": "1580345694.324303000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5213e96999294b27d740915b", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 412, "timestamp_epoch": "1580345694.324504000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3bb66962b9c8d6126be563d1", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 413, "timestamp_epoch": "1580345694.324740000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7c2fb78c4cb86c5ff5249637", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 414, "timestamp_epoch": "1580345694.324936000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7c981c7a5d46d6505d0708aa", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 415, "timestamp_epoch": "1580345694.325149000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e06c9cd3469fda3df6bbc40c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 416, "timestamp_epoch": "1580345694.325371000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0c011d531f7b8db3808b8cf8", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 417, "timestamp_epoch": "1580345694.325574000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1b4e39d1a39ca8568321a6eb", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1580345694.325718000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ebc60f69c027b6f097218244", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 419, "timestamp_epoch": "1580345694.325843000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f287890d3c3d9d5812666033", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1580345694.326028000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8b976ecc68f4abb2684b7501", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 421, "timestamp_epoch": "1580345694.326124000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-9e15a86feb998e11a521b1e2", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 422, "timestamp_epoch": "1580345694.326234000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3da5995a6ef9bf5c8f940165", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1580345694.326929000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3cbf4c1b23e8a632c20c5708", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 424, "timestamp_epoch": "1580345694.327084000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-bd830fa57079d48756ebaeec", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1580345694.327289000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bfd228cf55f2e8d3e73ef34f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1580345694.327389000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-349cf287177c5cee47de0abd", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 427, "timestamp_epoch": "1580345694.327714000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-03b4806780c2a48d7b6115b6", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1580345694.327853000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-fa00b082e7c9c415cdb74189", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 429, "timestamp_epoch": "1580345694.328043000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-915ffb9da64c641be11933f4", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1580345694.328370000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c8cbe65d1088e2bdca760837", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1580345694.328714000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0bd103696c44fca1b2bb106f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1580345694.328814000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2641986623608cb8f021118a", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1580345694.329165000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f6a92963fed503c88b3e0269", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1580345694.329373000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4149342fea047c5c2fd8411d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 437, "timestamp_epoch": "1580345694.329533000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-919a1e685a2af41929e9d3ce", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1580345694.329627000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-744f269cee56021b86180983", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 439, "timestamp_epoch": "1580345694.329727000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-15d263d4b8d3f02bd71037da", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1580345694.329918000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9d53faad396555f36cd5ea6b", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1580345694.330110000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a64b839fd432c621da3ec3e9", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1580345694.330259000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-644e556aba9a33c56a23bd0e", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1580345694.330632000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-49a88bfaed816b18abb2425c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1580345694.331016000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8dd24eacc6a049584bf4fd90", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1580345694.331161000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e059a12d8f9091881c6edc52", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1580345694.331260000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-17e57e0a254a0968c7c2b631", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1580345694.331452000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8caaacd0ee707c8f56bb9c74", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1580345694.331544000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-db8f923a10ee2a740b68157c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1580345694.331668000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-31ef3e0e67dd819760c4855c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1580345694.331761000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e198c4a0ea9be13c2ea36d75", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1580345694.331987000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f2e4b981038830e6b195d798", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 452, "timestamp_epoch": "1580345694.332091000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8e7bbcd023a2c801c635b98d", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 453, "timestamp_epoch": "1580345694.332360000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-543bd1ac38ecc6db13664666", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 454, "timestamp_epoch": "1580345694.332482000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b49bcf5e6b0d4f46bc6b2142", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1580345694.332984000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1153808accd7d86c86750ea6", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1580345694.333076000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c47012adc90956cf73b43ce7", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 462, "timestamp_epoch": "1580345694.346972000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5b2e08867c19132008c8f118", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 463, "timestamp_epoch": "1580345694.347221000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5de2c68aa9f94a058122fdc6", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1580345694.347854000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-33dd9ae6ffc4b3c092de9619", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1580345694.348009000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5aafab0dbb83f32764419cff", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 482, "timestamp_epoch": "1580345695.207284000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2229a32647d6c8262a805ccb", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 486, "timestamp_epoch": "1580345695.300974000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5fa2e1c0dfa423d917bf1025", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 487, "timestamp_epoch": "1580345695.301044000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-23f6814b8579c46662ba85a1", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 545, "timestamp_epoch": "1580345695.926523000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-9dfa096396b959253095e21d", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 547, "timestamp_epoch": "1580345695.927102000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-485f48a56c0f2da0d74baf00", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 548, "timestamp_epoch": "1580345695.927425000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b6dcf1bc62e39c70adf9cfdc", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 572, "timestamp_epoch": "1580345695.937083000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-45a17dcc9118176be75b38b4", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1580345695.937699000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c3ac479e26b285343d9a24f5", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1580345695.942425000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c023f9d40bd74f2f7001a8c3", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 587, "timestamp_epoch": "1580345695.943044000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-72406257f7bf2d1015a9c497", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 608, "timestamp_epoch": "1580345696.722942000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-14f703ddca7a3675ae3baa61", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 609, "timestamp_epoch": "1580345696.847984000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3915f8df0e1ef94f9a579acb", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 610, "timestamp_epoch": "1580345696.848105000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ddc2d065d401794d45eabbbb", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 611, "timestamp_epoch": "1580345697.613563000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e8ede9e3eaf16f3e8091bff4", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 612, "timestamp_epoch": "1580345697.613766000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a4895a20723113a68d728858", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 613, "timestamp_epoch": "1580345698.286821000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ccf96200a0fac75d5c0243be", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 614, "timestamp_epoch": "1580345698.380049000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a1b9117e6d448859e40f9a1d", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 615, "timestamp_epoch": "1580345698.380158000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ec4134ee4deaf5eda82c920d", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 616, "timestamp_epoch": "1580345699.066670000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5a014f08d4cfeb42cebc0ec6", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 617, "timestamp_epoch": "1580345699.144803000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a1c3f873f60a2ce94541c360", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 618, "timestamp_epoch": "1580345699.144893000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8cb49ad8e7f350b2bc13135a", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 619, "timestamp_epoch": "1580345699.816791000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9a3faa1026fd6bc65d5f8e1b", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 622, "timestamp_epoch": "1580345700.566834000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e02442be325043ef93be1cff", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 631, "timestamp_epoch": "1580345700.679007000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b56cb8e71cf6b72fcc0da69c", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 633, "timestamp_epoch": "1580345700.679712000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8a2dd852ff0e9ea6302a736d", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1580345700.809240000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-38ec17bab33712c1088ae9d0", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1580345700.810342000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a6a108be5870473305ec93b2", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 659, "timestamp_epoch": "1580345700.814917000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "30" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3da7e7740f3b6fa362f7a1a8", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 660, "timestamp_epoch": "1580345700.815421000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e2d78f64bfd9c7d2953159fb", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 667, "timestamp_epoch": "1580345700.816040000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5978c4460fecaf0674e24a2e", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 669, "timestamp_epoch": "1580345700.816658000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b75cbce9c4ddacf54dd6d03e", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 678, "timestamp_epoch": "1580345700.825815000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-4C02EMG$" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-86a628765f997e1f11a78c1e", "src_port": null, "tcp_stream": 34, "udp_stream": null, "frame_number": 681, "timestamp_epoch": "1580345700.826885000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "browser.server": "DESKTOP-4C02EMG" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2fe3b2bf6d1acf3bb521bea8", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 694, "timestamp_epoch": "1580345701.362494000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2cc6fba3f2db45560646c9a2", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 702, "timestamp_epoch": "1580345703.601735000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "30" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ce4a686be323347efac19915", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 703, "timestamp_epoch": "1580345703.602303000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "10", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-64ea3c89c3d72057b61d0030", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 710, "timestamp_epoch": "1580345703.613736000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "11", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-20d19c91f206631728016ad3", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 712, "timestamp_epoch": "1580345703.614372000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8a656a33ac6a9fdbca704902", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 721, "timestamp_epoch": "1580345703.620718000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1818881bd7986038e18937ee", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 724, "timestamp_epoch": "1580345703.621463000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-69f4f9b844c5fdf1ad2432ed", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 735, "timestamp_epoch": "1580345703.958318000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4415c0c713e6e3f7c6f52c20", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 737, "timestamp_epoch": "1580345703.958686000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e56e5d0dcdb3bfee48aa2754", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 739, "timestamp_epoch": "1580345703.959012000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-998a4b85ffe2750b868f2664", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 740, "timestamp_epoch": "1580345703.959066000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7ca06ec216f24dc6749920ad", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 742, "timestamp_epoch": "1580345703.959335000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-cbafbcc3bb2b2c0cfcbd0b9c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 744, "timestamp_epoch": "1580345703.960107000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-65ae104a188164e307acb099", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 750, "timestamp_epoch": "1580345703.960996000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c13836ae36d501a008447ffe", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 752, "timestamp_epoch": "1580345703.961730000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-07165d12ed1cefac70049b84", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 753, "timestamp_epoch": "1580345703.962068000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8cc345bf6470ce12beb45ae6", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 772, "timestamp_epoch": "1580345704.003871000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e23ddf8bbcb8bc3958cba78f", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 773, "timestamp_epoch": "1580345704.004229000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-917e80158e2760f36b8c3ad8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 774, "timestamp_epoch": "1580345704.004552000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-dc5ee3bf074f12cb5d5a25b3", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 779, "timestamp_epoch": "1580345704.007421000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "30" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b0c763b9a9703599820b6340", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 781, "timestamp_epoch": "1580345704.008179000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d7b561a5441c4846cb68be6e", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 785, "timestamp_epoch": "1580345704.029404000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0213a316a84919783c797567", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 786, "timestamp_epoch": "1580345704.029824000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "ntlmssp.auth.domain": "SOL-LIGHTNET", "ntlmssp.auth.hostname": "DESKTOP-Y6CNQTE", "ntlmssp.auth.username": "alejandrina.hogue" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-12bafc97b63fbf3e6c6a07e5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 787, "timestamp_epoch": "1580345704.030808000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ae840c32edabe1c96bf13401", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 788, "timestamp_epoch": "1580345704.034856000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f17ee7710a3d23e17441bdd8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 789, "timestamp_epoch": "1580345704.035502000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c5a6fb8fd6a4d5752277eddb", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 790, "timestamp_epoch": "1580345704.035707000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0c399cfbdab7e1c418de62be", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 791, "timestamp_epoch": "1580345704.035855000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-af79c9489118ad33d5fd71fe", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 792, "timestamp_epoch": "1580345704.036567000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2610f8bee726a6a2eacb91d5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 793, "timestamp_epoch": "1580345704.056695000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-82938a857ac40ee570bd752a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 794, "timestamp_epoch": "1580345704.057112000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-98e87a9a802282161dfc13a2", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 798, "timestamp_epoch": "1580345704.118287000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8a01b9d07be3581d80a876d4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 799, "timestamp_epoch": "1580345704.118486000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f19b5ad22f21c04664ddc51b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 802, "timestamp_epoch": "1580345704.150352000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-840d056a16f0694de51d3461", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 803, "timestamp_epoch": "1580345704.150662000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-769c922e152c6fb604b65577", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 804, "timestamp_epoch": "1580345704.162508000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4826fefcfaab1129ea1abfd1", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 805, "timestamp_epoch": "1580345704.162753000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-99c212deb78b773673d853a7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 806, "timestamp_epoch": "1580345704.162960000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-cc4789daf176669a6c6c095f", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 807, "timestamp_epoch": "1580345704.163467000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-980783fe387c33a6b4d8bab9", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 808, "timestamp_epoch": "1580345704.164228000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-068b53f891e0556379dd0c35", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 809, "timestamp_epoch": "1580345704.164464000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-01edba41ca93238d831f940d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 810, "timestamp_epoch": "1580345704.164864000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c3b6f3bba06dd186f446ca5d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 811, "timestamp_epoch": "1580345704.165107000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-78a254efb84cdf7d3854f55b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 812, "timestamp_epoch": "1580345704.165665000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8e868cf1354826a3970c0faf", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 813, "timestamp_epoch": "1580345704.166052000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9c8883101f4038e994dd370d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 814, "timestamp_epoch": "1580345704.167573000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a38f85926e9f44d1fda36e2d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 815, "timestamp_epoch": "1580345704.167925000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2adef436be1fba80b82a1678", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 816, "timestamp_epoch": "1580345704.169477000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-21da75664ae1341faff1f444", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 817, "timestamp_epoch": "1580345704.170054000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-848a562e73e35ab7b45df8d2", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 818, "timestamp_epoch": "1580345704.170618000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bc428d84c74424aedee07b16", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 819, "timestamp_epoch": "1580345704.171079000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6ca6b7a592480e6e50e39518", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 820, "timestamp_epoch": "1580345704.171814000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "samr.samr_UserInfo21.full_name": "Alejandrina Hogue", "samr.samr_UserInfo21.account_name": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-76e8698f08e725ecf99c23c4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 821, "timestamp_epoch": "1580345704.172301000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3407ad420d64b5149b05d67a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 822, "timestamp_epoch": "1580345704.172479000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4044748b4c33a945af0629f8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 823, "timestamp_epoch": "1580345704.174805000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-fb121ce522a3534df0bb8ea3", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 824, "timestamp_epoch": "1580345704.175103000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-49a6ccfcffee9703b81de470", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 825, "timestamp_epoch": "1580345704.175617000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d9e39b96e431bd9914bdf522", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 826, "timestamp_epoch": "1580345704.175953000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a21ce38beb13c7bb6f4c08ea", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 827, "timestamp_epoch": "1580345704.176484000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-11ce203d2e252c36583a0ab0", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 828, "timestamp_epoch": "1580345704.178212000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-43034ef4011bb3a62ab118c1", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 829, "timestamp_epoch": "1580345704.178491000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4b3b758bc67f423b18d16639", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 830, "timestamp_epoch": "1580345704.178948000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0ef301641a229c44da7fc28a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 831, "timestamp_epoch": "1580345704.179228000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b5afcbddf83bcd0bfcd53be7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1580345704.179566000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-fa405994f0c279a07aa276bf", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 833, "timestamp_epoch": "1580345704.179939000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-de6d533bbf00073e32e19eee", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 834, "timestamp_epoch": "1580345704.180212000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-104ec0a993fb1f491baa7abc", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 835, "timestamp_epoch": "1580345704.180505000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a608169f4124ce95d7a47787", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 836, "timestamp_epoch": "1580345704.180803000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c20ee797bcfe1f65d99b4433", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 837, "timestamp_epoch": "1580345704.180962000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b5efdd9cb15fa486ebaed9a6", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 842, "timestamp_epoch": "1580345704.204933000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e99c7d5ed8f96a7eb4aecaa3", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 843, "timestamp_epoch": "1580345704.205806000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b48195fc7b086bfe8150e2db", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 844, "timestamp_epoch": "1580345704.206115000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-de628826b1e6b571912f23da", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 849, "timestamp_epoch": "1580345704.208219000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-37ff8ff2827546706ffa9362", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 852, "timestamp_epoch": "1580345704.209310000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "12,14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-19e3496c4994d926c82facb4", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 861, "timestamp_epoch": "1580345704.210258000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "13", "kerberos.CNameString": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-28e6dab73f8393d94b8b7c45", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 864, "timestamp_epoch": "1580345704.210588000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6730e5b4525a2467955a5e9b", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 871, "timestamp_epoch": "1580345704.211741000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0811e9e4815717520f305a3e", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 873, "timestamp_epoch": "1580345704.213799000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9f846d37a3de19058ea840d9", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 874, "timestamp_epoch": "1580345704.215154000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-65659f90f4f276a13eb58923", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 875, "timestamp_epoch": "1580345704.215438000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a620d76cd0b070322c9b1d2f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 876, "timestamp_epoch": "1580345704.217786000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e18bfef56022da532597f377", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 877, "timestamp_epoch": "1580345704.217896000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7c2fa645acda88ea0eb6bcc7", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 878, "timestamp_epoch": "1580345704.217958000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-cb074647d1066725f30b9702", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 879, "timestamp_epoch": "1580345704.220102000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-51f54607e2d3df7db16bfaa5", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 894, "timestamp_epoch": "1580345704.329209000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1d465d8365f31aee48450883", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 896, "timestamp_epoch": "1580345704.330187000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9340814f49fd5a6efb442d8c", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 903, "timestamp_epoch": "1580345704.355249000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-da3186ef458c8b240ca06eaf", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 905, "timestamp_epoch": "1580345704.356166000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f19d6339945e13c67291f241", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 922, "timestamp_epoch": "1580345704.445156000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-be5a3f8dcf6ac5dc9574e909", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 924, "timestamp_epoch": "1580345704.522494000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0296c1c972983a331d1fd4a7", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 925, "timestamp_epoch": "1580345704.522868000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-253fe3a17bb8514080cb59e2", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 995, "timestamp_epoch": "1580345714.677358000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d4708f729edcc2a42f0032b2", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 996, "timestamp_epoch": "1580345714.677518000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-9ec27dda1f534b4d575f245b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 997, "timestamp_epoch": "1580345714.677763000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f377776dab3b621d31135007", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 998, "timestamp_epoch": "1580345714.677902000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4dd6d1efa63eabe84c6f7c14", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 999, "timestamp_epoch": "1580345714.678096000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1d887b785f54c6053fdc835b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 1000, "timestamp_epoch": "1580345714.678491000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d358e22aab2fdacfab70a820", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1015, "timestamp_epoch": "1580345718.097177000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a335aa1853e3dd49be191a8c", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1016, "timestamp_epoch": "1580345718.097444000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-936243587e41780ca22ae9db", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1017, "timestamp_epoch": "1580345718.112847000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8172102605906d057fb4bde3", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1018, "timestamp_epoch": "1580345718.113102000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b8d8126f70e511f2dd484d14", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1028, "timestamp_epoch": "1580345718.865652000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-d11fa40eb4935ebac018f23b", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1029, "timestamp_epoch": "1580345718.866015000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4fad3665889e43a23fc8e9da", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1030, "timestamp_epoch": "1580345718.866339000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-eed22da20eeae1c34e773a38", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1031, "timestamp_epoch": "1580345718.866536000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-72f0cae04bd923e96c34dd8b", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1044, "timestamp_epoch": "1580345747.696107000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c1ea112c09bde1db3224140f", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 1045, "timestamp_epoch": "1580345747.696387000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d409370407764abf4a9baa8e", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1062, "timestamp_epoch": "1580345751.394816000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3adaafe4c01117c4b3f28863", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1064, "timestamp_epoch": "1580345751.395517000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8d3fdd0e230025a2dc337fc9", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1065, "timestamp_epoch": "1580345751.397310000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-df6776838af439bcae395f4d", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1089, "timestamp_epoch": "1580345751.413193000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8797484b365485eea252482f", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1091, "timestamp_epoch": "1580345751.414003000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2bcde8294c49821a7a0d6b1e", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1102, "timestamp_epoch": "1580345751.422577000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-76e7208bbc5b8eb8cf1b35eb", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1104, "timestamp_epoch": "1580345751.423365000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-025eecf107e96fc10b25d39c", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1157, "timestamp_epoch": "1580345753.465765000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-67b9295c70f9829c985a0272", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1159, "timestamp_epoch": "1580345753.466606000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b7bae1f6b904939a2a258d23", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3516, "timestamp_epoch": "1580345765.013258000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-852746fc3280807e24281220", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3518, "timestamp_epoch": "1580345765.013905000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-56415b8bcfc68c8d09a856ac", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3519, "timestamp_epoch": "1580345765.014297000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b7bfcbb80b582d80cdd1c193", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3544, "timestamp_epoch": "1580345765.025808000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-995bcd694406f04f0ec0452a", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3546, "timestamp_epoch": "1580345765.026707000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5239d264eb2e849fc323519d", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3557, "timestamp_epoch": "1580345765.034925000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-30c6b2b5a26a3b3baac3f05c", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3559, "timestamp_epoch": "1580345765.035899000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c23e37c2aabc3038ca3f0eb0", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7625, "timestamp_epoch": "1580345809.607005000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e8de25cf6601d65f91c89427", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7626, "timestamp_epoch": "1580345811.169208000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d16ecb3e8d4928bfddd668a5", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7627, "timestamp_epoch": "1580345812.669914000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6002effbe781833e63514782", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7645, "timestamp_epoch": "1580345865.421549000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c7e87fc7026942ef13e8618c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7646, "timestamp_epoch": "1580345865.422009000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c065689629dfdd4598898198", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7647, "timestamp_epoch": "1580345865.422562000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0ae1d608393e126668bb7fa9", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7648, "timestamp_epoch": "1580345865.422877000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-aea3cf94de438c37f2da50a5", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7649, "timestamp_epoch": "1580345865.423193000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-334f34fcad1110f7da70111c", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7650, "timestamp_epoch": "1580345865.423464000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-fb7cf855af98e39603c60ac9", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7651, "timestamp_epoch": "1580345865.423756000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e9a7e5701a1cae2fff0b9325", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7652, "timestamp_epoch": "1580345865.424036000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-663d410330f55ca94ef65280", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7703, "timestamp_epoch": "1580345876.234179000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-2fd28bcb06d9b09d439b8e8f", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7704, "timestamp_epoch": "1580345876.234628000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7b6394c5471b5bb7d2101ee7", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7705, "timestamp_epoch": "1580345876.235069000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f2d965ee4b6f2d385fb0c644", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 7706, "timestamp_epoch": "1580345876.235340000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-628642582c82358af82af9f8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7715, "timestamp_epoch": "1580345929.610553000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-51ca00180f16a73fd874e265", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7716, "timestamp_epoch": "1580345931.250909000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-155257665d147980158655e8", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7717, "timestamp_epoch": "1580345932.750946000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "browser.server": "DESKTOP-4C02EMG" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-958be19460783d94bb251a8b", "src_port": null, "tcp_stream": null, "udp_stream": 23, "frame_number": 7718, "timestamp_epoch": "1580345938.809515000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c1f808eb09104b6f6d0b32ea", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7760, "timestamp_epoch": "1580345993.984378000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3e0d07d35fd53292c26cfbfc", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7762, "timestamp_epoch": "1580345993.985051000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9d921d9ac138b7416fab5b17", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7763, "timestamp_epoch": "1580345993.985469000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d5a9b75dedf922e0e8fb4186", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7787, "timestamp_epoch": "1580345993.995346000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4bbfa588ea3e315ac8493448", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7789, "timestamp_epoch": "1580345993.996111000" }, { "kind": "identity", "dst_ip": "10.20.30.2", "fields": { "eth.dst": "00:19:b9:fa:14:e6", "eth.src": "58:94:6b:77:9b:3c", "kerberos.msg_type": "14" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d6202a007d3a52619129ee9b", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7800, "timestamp_epoch": "1580345994.001465000" }, { "kind": "identity", "dst_ip": "10.20.30.227", "fields": { "eth.dst": "58:94:6b:77:9b:3c", "eth.src": "00:19:b9:fa:14:e6", "kerberos.msg_type": "15" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-011ff6a19db2197660212f22", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7802, "timestamp_epoch": "1580345994.002282000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ef9fe2e3ee3dedc48b61ec1e", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7852, "timestamp_epoch": "1580346049.641945000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-cee38d8dfa359053120d5cb4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7853, "timestamp_epoch": "1580346051.189108000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1b3d04a1fd31087c42a41083", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7854, "timestamp_epoch": "1580346052.704168000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6922628223e8dbf3c4743b48", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7924, "timestamp_epoch": "1580346133.535861000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2ecf00c1c76d6d13f6c8e78d", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7925, "timestamp_epoch": "1580346133.536248000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9f82cc450372cb51bf773918", "src_port": null, "tcp_stream": null, "udp_stream": 53, "frame_number": 7926, "timestamp_epoch": "1580346133.536724000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ffc007676349e969ee18e2ae", "src_port": null, "tcp_stream": null, "udp_stream": 53, "frame_number": 7930, "timestamp_epoch": "1580346133.947928000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-50260cb161e64657d05181cb", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7933, "timestamp_epoch": "1580346134.541963000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-814170d3755a35876272b40d", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7935, "timestamp_epoch": "1580346135.041002000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-18663833238776919000b5c2", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7940, "timestamp_epoch": "1580346135.070382000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5f02f48d9bbb7e738e8504a6", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7941, "timestamp_epoch": "1580346135.071126000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9c7e02ca33001bb9cb546164", "src_port": null, "tcp_stream": null, "udp_stream": 57, "frame_number": 7942, "timestamp_epoch": "1580346135.072144000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-00047cdf45bb8436fd0d8345", "src_port": null, "tcp_stream": null, "udp_stream": 57, "frame_number": 7943, "timestamp_epoch": "1580346135.494471000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4976281e47f3d24de6c1a475", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7945, "timestamp_epoch": "1580346135.748371000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b3984f6cee9d7b4036c2efd5", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7947, "timestamp_epoch": "1580346136.076122000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7da260b9364860fad584d0a3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7975, "timestamp_epoch": "1580346136.541041000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e7bbfafa8535c09e04f1e4d3", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7977, "timestamp_epoch": "1580346136.572598000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e7fb31aef6c6a96bf677d757", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7980, "timestamp_epoch": "1580346136.749078000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-159e0bf5c475bf984f27e4e9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 7981, "timestamp_epoch": "1580346138.073713000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c6ea17048f88eab85547d159", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7982, "timestamp_epoch": "1580346138.089079000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "_googlecast._tcp.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c8165bd4edf601f4a979696f", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 7983, "timestamp_epoch": "1580346138.750794000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-bdcb3b5980ac4963aabaecf1", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7984, "timestamp_epoch": "1580346138.847029000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-20e7859fdcbd2ff0e34821a3", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7987, "timestamp_epoch": "1580346139.605468000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a0223862f87463e760ffc3e7", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 7988, "timestamp_epoch": "1580346139.621958000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "NOVVSLYN<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-df8e4bc871799444133121d4", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8002, "timestamp_epoch": "1580346140.102154000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SRJNZGVKLQXNA<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c111fc177c8e6722db3ee0a4", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8003, "timestamp_epoch": "1580346140.102821000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "novvslyn.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-25732e1d41fccb06359b59ac", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8004, "timestamp_epoch": "1580346140.103032000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "novvslyn" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-210df0d76ddd203e97a66551", "src_port": null, "tcp_stream": null, "udp_stream": 66, "frame_number": 8005, "timestamp_epoch": "1580346140.104473000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "ZPCKJIKZGJVCK<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-85029a4f9e2a1de703e2d59c", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8006, "timestamp_epoch": "1580346140.105381000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "srjnzgvklqxna.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b0aaf4c3ff457ddb63df7e5e", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8007, "timestamp_epoch": "1580346140.109028000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "zpckjikzgjvck.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-38993612fe757090f5207104", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8008, "timestamp_epoch": "1580346140.109610000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "srjnzgvklqxna" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1519bb502d7f9c4689a95a9c", "src_port": null, "tcp_stream": null, "udp_stream": 67, "frame_number": 8009, "timestamp_epoch": "1580346140.110405000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "zpckjikzgjvck" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c80cb7d2c6856107ab34c34c", "src_port": null, "tcp_stream": null, "udp_stream": 68, "frame_number": 8010, "timestamp_epoch": "1580346140.110529000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-af3df79567c5f0be0604ef55", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8011, "timestamp_epoch": "1580346140.385311000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "novvslyn" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-739957f920630d552bdff242", "src_port": null, "tcp_stream": null, "udp_stream": 66, "frame_number": 8012, "timestamp_epoch": "1580346140.526444000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "zpckjikzgjvck" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-abca6c4cba96d67e0cb7c447", "src_port": null, "tcp_stream": null, "udp_stream": 68, "frame_number": 8013, "timestamp_epoch": "1580346140.527114000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "srjnzgvklqxna" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-58460254ed4f145f45b098db", "src_port": null, "tcp_stream": null, "udp_stream": 67, "frame_number": 8014, "timestamp_epoch": "1580346140.527631000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "NOVVSLYN<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8b6a036a69914d89434100c7", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8033, "timestamp_epoch": "1580346140.853853000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SRJNZGVKLQXNA<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-424be5da9265a177ba83caf0", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8034, "timestamp_epoch": "1580346140.853966000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "ZPCKJIKZGJVCK<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0eae606d5fbdf31675bc61b1", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8035, "timestamp_epoch": "1580346140.869299000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "novvslyn.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3c2902604ac495fef893cafe", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8036, "timestamp_epoch": "1580346141.104684000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "srjnzgvklqxna.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-44194ac0835c28a3af487202", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8037, "timestamp_epoch": "1580346141.120246000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "zpckjikzgjvck.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-154e263dc07e05c881702530", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8038, "timestamp_epoch": "1580346141.120426000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-04fc61d648d7c689b27071e7", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8039, "timestamp_epoch": "1580346141.135859000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "SRJNZGVKLQXNA<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4a6ec2f0f68b5a3f7ce37c71", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8040, "timestamp_epoch": "1580346141.605170000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "NOVVSLYN<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-edcbff1c4a49ad61a731aa1c", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8041, "timestamp_epoch": "1580346141.605334000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "ZPCKJIKZGJVCK<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-cd622e96b2ca082010bfa6ac", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8042, "timestamp_epoch": "1580346141.620665000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-67a317becb85b5b6527e8276", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8044, "timestamp_epoch": "1580346142.545286000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2f7a3fff251e8a2404f03895", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8045, "timestamp_epoch": "1580346142.545649000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2fd3f4bc1e62153eadf11ae7", "src_port": null, "tcp_stream": null, "udp_stream": 69, "frame_number": 8046, "timestamp_epoch": "1580346142.546052000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e55d52534c5b52cea80a3472", "src_port": null, "tcp_stream": null, "udp_stream": 69, "frame_number": 8048, "timestamp_epoch": "1580346142.952189000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-34566a3b0264c2775677624b", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8049, "timestamp_epoch": "1580346143.293276000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9766c8c0f39ae42087b2da5b", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8050, "timestamp_epoch": "1580346144.042971000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-992d9cb0d2839e43e506f866", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8051, "timestamp_epoch": "1580346144.095129000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-88096eab297bf60c468766fe", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8052, "timestamp_epoch": "1580346144.095726000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4c5fadd3d228f45deb581b8f", "src_port": null, "tcp_stream": null, "udp_stream": 70, "frame_number": 8053, "timestamp_epoch": "1580346144.096551000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7da0b66e13d5674bbf53ca9b", "src_port": null, "tcp_stream": null, "udp_stream": 70, "frame_number": 8054, "timestamp_epoch": "1580346144.512208000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b01eec9d37448130506863f7", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8055, "timestamp_epoch": "1580346144.857416000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4f3419b125142176116ff9e8", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 8056, "timestamp_epoch": "1580346145.092070000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1e763b134e8e1583e3597a17", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 8057, "timestamp_epoch": "1580346145.622725000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7fd46b97316b26417945c737", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9155, "timestamp_epoch": "1580346169.644473000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2175270704ba9920298ac263", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9184, "timestamp_epoch": "1580346171.151282000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-312d4b41d0385a7ac93dd4d9", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9274, "timestamp_epoch": "1580346172.656450000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2e834090958f33811c751095", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 9924, "timestamp_epoch": "1580346175.658380000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4ccae688339fd7192d5364cd", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 9925, "timestamp_epoch": "1580346175.658589000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6c11e629c6ffb145b07cdec5", "src_port": null, "tcp_stream": null, "udp_stream": 90, "frame_number": 9926, "timestamp_epoch": "1580346175.658982000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-462047fe6dc2793d9e7241bf", "src_port": null, "tcp_stream": null, "udp_stream": 90, "frame_number": 10606, "timestamp_epoch": "1580346176.082359000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "58:94:6b:77:9b:3c", "dns.qry.name": "wpad.local" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-fe7bde0d219c57db379a9730", "src_port": null, "tcp_stream": null, "udp_stream": 52, "frame_number": 11068, "timestamp_epoch": "1580346176.658991000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d3c2eb8c155e1af4982c0dd4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 12028, "timestamp_epoch": "1580346177.158805000" }, { "kind": "identity", "dst_ip": "10.20.30.1", "fields": { "eth.dst": "00:04:c0:94:66:d5", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-577afe85a79ec48c1863fdbf", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 12802, "timestamp_epoch": "1580346178.667654000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7ee1ab9482a246b7213d2b68", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 12803, "timestamp_epoch": "1580346180.229495000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0e768e744015bf584eb67557", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 12804, "timestamp_epoch": "1580346180.998083000" }, { "kind": "identity", "dst_ip": "10.20.30.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "58:94:6b:77:9b:3c", "nbns.name": "WPAD<00>", "nbns.flags.opcode": "0", "nbns.flags.response": "False" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-cee1fb2ff2cf51049b7c40fd", "src_port": null, "tcp_stream": null, "udp_stream": 20, "frame_number": 12806, "timestamp_epoch": "1580346181.763084000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "23.51.186.146", "fields": { "http.host": "go.microsoft.com", "http.user_agent": "MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT", "http.request.uri": "/fwlink/?LinkID=252669&clcid=0x409", "http.response_in": "494", "http.content_length": "1242", "http.request.method": "POST", "http.request.full_uri": "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-b627aab585c045c3024f5159", "src_port": 49696, "tcp_stream": 23, "udp_stream": null, "body_sha256": "801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7", "frame_number": 492, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1242, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1242, "timestamp_epoch": "1580345695.322080000" }, { "kind": "http_request", "dst_ip": "40.67.249.61", "fields": { "http.host": "dmd.metaservices.microsoft.com", "http.user_agent": "MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT", "http.request.uri": "/metadata.svc", "http.response_in": "509", "http.content_length": "1242", "http.request.method": "POST", "http.request.full_uri": "http://dmd.metaservices.microsoft.com/metadata.svc" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-5317e50c9892544c325d430c", "src_port": 49697, "tcp_stream": 24, "udp_stream": null, "body_sha256": "801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7", "frame_number": 506, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1242, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1242, "timestamp_epoch": "1580345695.523568000" }, { "kind": "http_request", "dst_ip": "23.51.186.146", "fields": { "http.host": "go.microsoft.com", "http.user_agent": "MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT", "http.request.uri": "/fwlink/?LinkID=252669&clcid=0x409", "http.response_in": "524", "http.content_length": "2048", "http.request.method": "POST", "http.request.full_uri": "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-16f5e51c6053c00b58f3029b", "src_port": 49698, "tcp_stream": 25, "udp_stream": null, "body_sha256": "431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b", "frame_number": 520, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2048, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2048, "timestamp_epoch": "1580345695.834804000" }, { "kind": "http_request", "dst_ip": "40.67.249.61", "fields": { "http.host": "dmd.metaservices.microsoft.com", "http.user_agent": "MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT", "http.request.uri": "/metadata.svc", "http.response_in": "606", "http.content_length": "2048", "http.request.method": "POST", "http.request.full_uri": "http://dmd.metaservices.microsoft.com/metadata.svc" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-1aa251eb7c55154ead60d8ba", "src_port": 49697, "tcp_stream": 24, "udp_stream": null, "body_sha256": "431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b", "frame_number": 531, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2048, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2048, "timestamp_epoch": "1580345695.893444000" }, { "kind": "http_request", "dst_ip": "49.51.133.162", "fields": { "http.host": "gengrasjeepram.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/sv.exe", "http.response_in": "1235", "http.request.method": "GET", "http.request.full_uri": "http://gengrasjeepram.com/sv.exe" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-493cc4b8e133174c02e58207", "src_port": 49728, "tcp_stream": 55, "udp_stream": null, "frame_number": 1169, "timestamp_epoch": "1580345757.655509000" }, { "kind": "http_request", "dst_ip": "184.73.165.106", "fields": { "http.host": "api.ipify.org", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/", "http.response_in": "1244", "http.request.method": "GET", "http.request.full_uri": "http://api.ipify.org/" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-80f3dd1e79810ebec36f0077", "src_port": 49729, "tcp_stream": 56, "udp_stream": null, "frame_number": 1242, "timestamp_epoch": "1580345758.403785000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/4/forum.php", "http.response_in": "1253", "http.content_length": "135", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/4/forum.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-9bbf8996fc83c76e49d88e5e", "src_port": 49730, "tcp_stream": 57, "udp_stream": null, "body_sha256": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "frame_number": 1251, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 135, "timestamp_epoch": "1580345758.838022000" }, { "kind": "http_request", "dst_ip": "148.66.137.40", "fields": { "http.host": "xolightfinance.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/bhola/images/1", "http.response_in": "1306", "http.request.method": "GET", "http.request.full_uri": "http://xolightfinance.com/bhola/images/1" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-f2f6848bc96a91dfde83bfa8", "src_port": 49731, "tcp_stream": 58, "udp_stream": null, "frame_number": 1260, "timestamp_epoch": "1580345759.390149000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/mlu/forum.php", "http.response_in": "1317", "http.content_length": "191", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/mlu/forum.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-da599456958830eb90fff32c", "src_port": 49732, "tcp_stream": 59, "udp_stream": null, "frame_number": 1315, "timestamp_epoch": "1580345760.647757000" }, { "kind": "http_request", "dst_ip": "148.66.137.40", "fields": { "http.host": "xolightfinance.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/bhola/images/2", "http.response_in": "3487", "http.request.method": "GET", "http.request.full_uri": "http://xolightfinance.com/bhola/images/2" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-2c5f20bcda8a9eacbf0fc56b", "src_port": 49731, "tcp_stream": 58, "udp_stream": null, "frame_number": 3430, "timestamp_epoch": "1580345764.042624000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)", "http.request.uri": "/d2/about.php", "http.response_in": "3589", "http.content_length": "237", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/d2/about.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-e8c0db07c779fb24a4ddbccc", "src_port": 49736, "tcp_stream": 63, "udp_stream": null, "frame_number": 3586, "timestamp_epoch": "1580345765.163080000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/4/forum.php", "http.response_in": "7713", "http.content_length": "135", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/4/forum.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-ef138b54b249dc3c6359d238", "src_port": 49742, "tcp_stream": 70, "udp_stream": null, "body_sha256": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "frame_number": 7711, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 135, "timestamp_epoch": "1580345885.104183000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/4/forum.php", "http.response_in": "7825", "http.content_length": "135", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/4/forum.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-eeb5e31cd6e5a5df9684edd0", "src_port": 49748, "tcp_stream": 76, "udp_stream": null, "body_sha256": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "frame_number": 7823, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 135, "timestamp_epoch": "1580346005.497228000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/4/forum.php", "http.response_in": "7918", "http.content_length": "135", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/4/forum.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-e9f44717e0003bd13f11aff9", "src_port": 49752, "tcp_stream": 80, "udp_stream": null, "body_sha256": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "frame_number": 7916, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 135, "timestamp_epoch": "1580346125.870845000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5f2937d13235d27e52e9c6f8", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7927, "timestamp_epoch": "1580346133.604864000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-142edad574d471e9e9e73619", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7934, "timestamp_epoch": "1580346134.620020000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1f7face8208c5628b0b117e9", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7944, "timestamp_epoch": "1580346135.620959000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3d5fdc574dda753c9ee37b8a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7974, "timestamp_epoch": "1580346136.539734000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-af0ed8be0ee849c51078409a", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7976, "timestamp_epoch": "1580346136.545842000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1b3921fadccbe7168d132e57", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7978, "timestamp_epoch": "1580346136.621248000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1ff2c1655a0ae1c21ebf1319", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7979, "timestamp_epoch": "1580346136.725775000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-dfe112409f259f873327421f", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7985, "timestamp_epoch": "1580346139.526402000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ee26df6762692bebaa1396a6", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7986, "timestamp_epoch": "1580346139.543253000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a2e82e46aebe379614c6e504", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 7989, "timestamp_epoch": "1580346139.730927000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8546a38347a3e3efcee772a4", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8043, "timestamp_epoch": "1580346142.542100000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0aef00dbfd987eb77ad0e2a0", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 8047, "timestamp_epoch": "1580346142.557724000" }, { "kind": "http_request", "dst_ip": "216.58.194.46", "fields": { "http.host": "google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/", "http.response_in": "8224", "http.request.method": "GET", "http.request.full_uri": "http://google.com/" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-e339e1ce020ab7f0ab3eef3c", "src_port": 49764, "tcp_stream": 89, "udp_stream": null, "frame_number": 8222, "timestamp_epoch": "1580346162.739566000" }, { "kind": "http_request", "dst_ip": "216.58.193.132", "fields": { "http.host": "www.google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/", "http.response_in": "8233", "http.request.method": "GET", "http.request.full_uri": "http://www.google.com/" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-c91d284cd8eb4288ebefab7a", "src_port": 49766, "tcp_stream": 91, "udp_stream": null, "frame_number": 8231, "timestamp_epoch": "1580346162.810738000" }, { "kind": "http_request", "dst_ip": "216.58.193.132", "fields": { "http.host": "www.google.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L", "http.response_in": "9927", "http.request.method": "GET", "http.request.full_uri": "http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-0dc274750ae6d0c19f78bdba", "src_port": 49766, "tcp_stream": 91, "udp_stream": null, "frame_number": 9913, "timestamp_epoch": "1580346175.652447000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/", "http.response_in": "9963", "http.request.method": "GET", "http.request.full_uri": "http://www.tippingpointhampstead.com/" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-2f10a8b1c1ab48ca58084e19", "src_port": 49781, "tcp_stream": 106, "udp_stream": null, "frame_number": 9949, "timestamp_epoch": "1580346175.871552000" }, { "kind": "http_request", "dst_ip": "104.81.85.107", "fields": { "http.host": "use.typekit.net", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js", "http.response_in": "10081", "http.request.method": "GET", "http.request.full_uri": "http://use.typekit.net/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-520d54915086ab0e883fd9a3", "src_port": 49783, "tcp_stream": 108, "udp_stream": null, "frame_number": 9976, "timestamp_epoch": "1580346176.004846000" }, { "kind": "http_request", "dst_ip": "104.97.213.249", "fields": { "http.host": "assets.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js", "http.response_in": "10744", "http.request.method": "GET", "http.request.full_uri": "http://assets.squarespace.com/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-b5d0d352b8603bcc6a9e319f", "src_port": 49784, "tcp_stream": 109, "udp_stream": null, "frame_number": 9991, "timestamp_epoch": "1580346176.011638000" }, { "kind": "http_request", "dst_ip": "104.97.213.249", "fields": { "http.host": "assets.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js", "http.response_in": "10645", "http.request.method": "GET", "http.request.full_uri": "http://assets.squarespace.com/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-d547b1ff4bd492276e3859a9", "src_port": 49787, "tcp_stream": 112, "udp_stream": null, "frame_number": 9993, "timestamp_epoch": "1580346176.011929000" }, { "kind": "http_request", "dst_ip": "104.97.213.249", "fields": { "http.host": "assets.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js", "http.response_in": "10068", "http.request.method": "GET", "http.request.full_uri": "http://assets.squarespace.com/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-63bbf8e0033c04818cfea2f6", "src_port": 49785, "tcp_stream": 110, "udp_stream": null, "frame_number": 9995, "timestamp_epoch": "1580346176.012077000" }, { "kind": "http_request", "dst_ip": "104.97.213.249", "fields": { "http.host": "assets.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css", "http.response_in": "10037", "http.request.method": "GET", "http.request.full_uri": "http://assets.squarespace.com/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-d0f4be31988c3969c1d996e8", "src_port": 49786, "tcp_stream": 111, "udp_stream": null, "frame_number": 9999, "timestamp_epoch": "1580346176.012348000" }, { "kind": "http_request", "dst_ip": "151.101.0.238", "fields": { "http.host": "static1.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false", "http.response_in": "10246", "http.request.method": "GET", "http.request.full_uri": "http://static1.squarespace.com/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-3dd7f771c905b35de5bba346", "src_port": 49789, "tcp_stream": 114, "udp_stream": null, "frame_number": 10010, "timestamp_epoch": "1580346176.020125000" }, { "kind": "http_request", "dst_ip": "151.101.0.238", "fields": { "http.host": "static1.squarespace.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/static/531a38d5e4b06ab55728bbcd/t/535732bde4b0ff45f1eff4ee/1575563567328/?format=1500w", "http.response_in": "10083", "http.request.method": "GET", "http.request.full_uri": "http://static1.squarespace.com/static/531a38d5e4b06ab55728bbcd/t/535732bde4b0ff45f1eff4ee/1575563567328/?format=1500w" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-b572daa851a7245d587fe803", "src_port": 49791, "tcp_stream": 116, "udp_stream": null, "frame_number": 10012, "timestamp_epoch": "1580346176.020274000" }, { "kind": "http_request", "dst_ip": "172.217.14.170", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/css?family=Lato:100,400,700i,700,400i", "http.response_in": "10196", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Lato:100,400,700i,700,400i" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-adc3fa56a957913071756bdf", "src_port": 49788, "tcp_stream": 113, "udp_stream": null, "frame_number": 10016, "timestamp_epoch": "1580346176.022922000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/census/RecordHit", "http.response_in": "11473", "http.content_length": "1054", "http.request.method": "POST", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/census/RecordHit" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-83becf949722bc437546a302", "src_port": 49781, "tcp_stream": 106, "udp_stream": null, "body_sha256": "731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d", "frame_number": 11070, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1054, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1054, "timestamp_epoch": "1580346176.888399000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/1/performance/settings", "http.response_in": "11147", "http.request.method": "GET", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/1/performance/settings" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-8fb99276b355427a8fb6d61e", "src_port": 49782, "tcp_stream": 107, "udp_stream": null, "frame_number": 11073, "timestamp_epoch": "1580346176.893673000" }, { "kind": "http_request", "dst_ip": "172.217.14.163", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2", "http.response_in": "11148", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-58f2851af22ad54644edb630", "src_port": 49792, "tcp_stream": 117, "udp_stream": null, "frame_number": 11080, "timestamp_epoch": "1580346176.917041000" }, { "kind": "http_request", "dst_ip": "172.217.14.163", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2", "http.response_in": "11212", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-8a05d6088741f02366631368", "src_port": 49795, "tcp_stream": 120, "udp_stream": null, "frame_number": 11111, "timestamp_epoch": "1580346176.932931000" }, { "kind": "http_request", "dst_ip": "172.217.14.163", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2", "http.response_in": "11220", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-5d31c3cca0a80d02dbe8844b", "src_port": 49796, "tcp_stream": 121, "udp_stream": null, "frame_number": 11122, "timestamp_epoch": "1580346176.934102000" }, { "kind": "http_request", "dst_ip": "81.177.6.156", "fields": { "http.host": "twereptale.com", "http.user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "http.request.uri": "/4/forum.php", "http.response_in": "12857", "http.content_length": "135", "http.request.method": "POST", "http.request.full_uri": "http://twereptale.com/4/forum.php" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-b850dfe267e6f1653ee49500", "src_port": 49802, "tcp_stream": 127, "udp_stream": null, "body_sha256": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "frame_number": 12855, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 135, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 135, "timestamp_epoch": "1580346246.270378000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f476315410a11a94e65e7ee4", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 12867, "timestamp_epoch": "1580346253.474549000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-69b284de2bbba59621220903", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 12876, "timestamp_epoch": "1580346254.484734000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2d90d9c5dd3c87ffe3db51d2", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 12879, "timestamp_epoch": "1580346255.484867000" }, { "kind": "http_request", "dst_ip": "239.255.255.250", "fields": { "http.host": "239.255.255.250:1900", "http.user_agent": "Microsoft Edge/79.0.309.71 Windows", "http.request.uri": "*", "http.request.method": "M-SEARCH", "http.request.full_uri": "http://239.255.255.250:1900*" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1fcaa35fb68544a2f7713949", "src_port": null, "tcp_stream": null, "udp_stream": null, "frame_number": 12880, "timestamp_epoch": "1580346256.499874000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/contact", "http.response_in": "12942", "http.request.method": "GET", "http.request.full_uri": "http://www.tippingpointhampstead.com/contact" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-f8d3ec6dcb96592ee9d9a8e8", "src_port": 49803, "tcp_stream": 128, "udp_stream": null, "frame_number": 12904, "timestamp_epoch": "1580346260.307088000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/1/performance/records", "http.response_in": "12952", "http.content_length": "2385", "http.request.method": "POST", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/1/performance/records" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-913379f80f87011e34ed063e", "src_port": 49804, "tcp_stream": 129, "udp_stream": null, "body_sha256": "e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f", "frame_number": 12912, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2385, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2385, "timestamp_epoch": "1580346260.315953000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/1/performance/records", "http.response_in": "12954", "http.content_length": "1205", "http.request.method": "POST", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/1/performance/records" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-431c8cd766559e37a1c56255", "src_port": 49803, "tcp_stream": 128, "udp_stream": null, "body_sha256": "a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce", "frame_number": 12946, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1205, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1205, "timestamp_epoch": "1580346260.376231000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/census/RecordHit", "http.response_in": "13037", "http.content_length": "876", "http.request.method": "POST", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/census/RecordHit" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-bdd96af2d97b5aa6527180ef", "src_port": 49803, "tcp_stream": 128, "udp_stream": null, "body_sha256": "39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5", "frame_number": 12957, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 876, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 876, "timestamp_epoch": "1580346261.126327000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/events/RecordEvent", "http.response_in": "12980", "http.content_length": "314", "http.request.method": "POST", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/events/RecordEvent" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-75b09468d07a00e689101511", "src_port": 49804, "tcp_stream": 129, "udp_stream": null, "body_sha256": "48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f", "frame_number": 12960, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 314, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 314, "timestamp_epoch": "1580346261.127758000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/census/form-render", "http.response_in": "12992", "http.content_length": "247", "http.request.method": "POST", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/census/form-render" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-1322dfd64cb0abbad0cf0a6c", "src_port": 49807, "tcp_stream": 132, "udp_stream": null, "body_sha256": "064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df", "frame_number": 12962, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 247, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 247, "timestamp_epoch": "1580346261.128864000" }, { "kind": "http_request", "dst_ip": "198.185.159.144", "fields": { "http.host": "www.tippingpointhampstead.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/api/1/performance/settings", "http.response_in": "13011", "http.request.method": "GET", "http.request.full_uri": "http://www.tippingpointhampstead.com/api/1/performance/settings" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-f4fd42b762b02c8dd800dff0", "src_port": 49808, "tcp_stream": 133, "udp_stream": null, "frame_number": 12979, "timestamp_epoch": "1580346261.183798000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US", "http.response_in": "13035", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-18a19b73b3572ffcf2d0d7cb", "src_port": 49809, "tcp_stream": 134, "udp_stream": null, "frame_number": 12989, "timestamp_epoch": "1580346261.207430000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/common.js", "http.response_in": "13084", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/common.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-6db22aaa55dce7d2624ec8f0", "src_port": 49809, "tcp_stream": 134, "udp_stream": null, "frame_number": 13042, "timestamp_epoch": "1580346261.292989000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/util.js", "http.response_in": "13163", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/util.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-5e28b57419fdb64d67f8dbd4", "src_port": 49810, "tcp_stream": 135, "udp_stream": null, "frame_number": 13052, "timestamp_epoch": "1580346261.352193000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/map.js", "http.response_in": "13121", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/map.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-96e9fd03dfc8b0240366c340", "src_port": 49812, "tcp_stream": 137, "udp_stream": null, "frame_number": 13054, "timestamp_epoch": "1580346261.352375000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/marker.js", "http.response_in": "13093", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/marker.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-94676d3be99c020cb8f7b637", "src_port": 49811, "tcp_stream": 136, "udp_stream": null, "frame_number": 13056, "timestamp_epoch": "1580346261.352557000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/onion.js", "http.response_in": "13178", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/onion.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-59277b53c1edea82e0474baa", "src_port": 49810, "tcp_stream": 135, "udp_stream": null, "frame_number": 13167, "timestamp_epoch": "1580346261.465995000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/stats.js", "http.response_in": "13181", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/stats.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-cfc72438ce6f70fbe2586392", "src_port": 49812, "tcp_stream": 137, "udp_stream": null, "frame_number": 13169, "timestamp_epoch": "1580346261.466132000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13228", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-182b4ae98638d50a83fb9d91", "src_port": 49810, "tcp_stream": 135, "udp_stream": null, "frame_number": 13187, "timestamp_epoch": "1580346261.491507000" }, { "kind": "http_request", "dst_ip": "172.217.2.227", "fields": { "http.host": "maps.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/mapfiles/openhand_8_8.cur", "http.response_in": "13225", "http.request.method": "GET", "http.request.full_uri": "http://maps.gstatic.com/mapfiles/openhand_8_8.cur" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-8f88be539382f56bfda2796c", "src_port": 49813, "tcp_stream": 138, "udp_stream": null, "frame_number": 13191, "timestamp_epoch": "1580346261.504672000" }, { "kind": "http_request", "dst_ip": "172.217.2.238", "fields": { "http.host": "khm0.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/kh?v=863&hl=en&x=2134&y=3318&z=13", "http.response_in": "13299", "http.request.method": "GET", "http.request.full_uri": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3318&z=13" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-79ec1ad6201ec0c19fb187ce", "src_port": 49814, "tcp_stream": 139, "udp_stream": null, "frame_number": 13203, "timestamp_epoch": "1580346261.528788000" }, { "kind": "http_request", "dst_ip": "172.217.12.46", "fields": { "http.host": "khm1.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/kh?v=863&hl=en&x=2133&y=3318&z=13", "http.response_in": "13334", "http.request.method": "GET", "http.request.full_uri": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3318&z=13" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-541532c8f4503440a421e039", "src_port": 49816, "tcp_stream": 141, "udp_stream": null, "frame_number": 13215, "timestamp_epoch": "1580346261.530511000" }, { "kind": "http_request", "dst_ip": "172.217.2.238", "fields": { "http.host": "khm0.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/kh?v=863&hl=en&x=2134&y=3317&z=13", "http.response_in": "13335", "http.request.method": "GET", "http.request.full_uri": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3317&z=13" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-cd9737ae2227d57037d93f0e", "src_port": 49815, "tcp_stream": 140, "udp_stream": null, "frame_number": 13217, "timestamp_epoch": "1580346261.530661000" }, { "kind": "http_request", "dst_ip": "172.217.12.46", "fields": { "http.host": "khm1.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/kh?v=863&hl=en&x=2133&y=3317&z=13", "http.response_in": "13336", "http.request.method": "GET", "http.request.full_uri": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3317&z=13" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-69b7404ef889bc9c139b73eb", "src_port": 49817, "tcp_stream": 142, "udp_stream": null, "frame_number": 13219, "timestamp_epoch": "1580346261.530786000" }, { "kind": "http_request", "dst_ip": "172.217.12.46", "fields": { "http.host": "khm1.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/kh?v=863&hl=en&x=2135&y=3317&z=13", "http.response_in": "13328", "http.request.method": "GET", "http.request.full_uri": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3317&z=13" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-03930a83d4a8569491861688", "src_port": 49818, "tcp_stream": 143, "udp_stream": null, "frame_number": 13221, "timestamp_epoch": "1580346261.530932000" }, { "kind": "http_request", "dst_ip": "172.217.12.46", "fields": { "http.host": "khm1.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/kh?v=863&hl=en&x=2135&y=3318&z=13", "http.response_in": "13357", "http.request.method": "GET", "http.request.full_uri": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3318&z=13" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-d9404f2eb77ff14e8bfdb81b", "src_port": 49819, "tcp_stream": 144, "udp_stream": null, "frame_number": 13223, "timestamp_epoch": "1580346261.531130000" }, { "kind": "http_request", "dst_ip": "172.217.2.227", "fields": { "http.host": "maps.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/mapfiles/transparent.png", "http.response_in": "13359", "http.request.method": "GET", "http.request.full_uri": "http://maps.gstatic.com/mapfiles/transparent.png" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-b013f621bbb92fcea56870b5", "src_port": 49813, "tcp_stream": 138, "udp_stream": null, "frame_number": 13302, "timestamp_epoch": "1580346261.557116000" }, { "kind": "http_request", "dst_ip": "172.217.2.227", "fields": { "http.host": "maps.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/mapfiles/api-3/images/spotlight-poi2.png", "http.response_in": "13372", "http.request.method": "GET", "http.request.full_uri": "http://maps.gstatic.com/mapfiles/api-3/images/spotlight-poi2.png" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-6ea315cc7023b9a2a17b343a", "src_port": 49820, "tcp_stream": 145, "udp_stream": null, "frame_number": 13353, "timestamp_epoch": "1580346261.578833000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13387", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-8601bfa9ca769953b77ce819", "src_port": 49810, "tcp_stream": 135, "udp_stream": null, "frame_number": 13360, "timestamp_epoch": "1580346261.596304000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13383", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-f9ed49e5a717e374a31d08c6", "src_port": 49812, "tcp_stream": 137, "udp_stream": null, "frame_number": 13362, "timestamp_epoch": "1580346261.597334000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13390", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-fdad69015070c69db50ea015", "src_port": 49811, "tcp_stream": 136, "udp_stream": null, "frame_number": 13364, "timestamp_epoch": "1580346261.598688000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13395", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-43208ea1bcaec09ea008c524", "src_port": 49809, "tcp_stream": 134, "udp_stream": null, "frame_number": 13366, "timestamp_epoch": "1580346261.599495000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13400", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-4154121c4cb3b1b11fbb5ea5", "src_port": 49821, "tcp_stream": 146, "udp_stream": null, "frame_number": 13377, "timestamp_epoch": "1580346261.614212000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13397", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-e52401524eb1a0071eafde89", "src_port": 49822, "tcp_stream": 147, "udp_stream": null, "frame_number": 13379, "timestamp_epoch": "1580346261.614438000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13403", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-3b7aca1adba89e41e66563f1", "src_port": 49812, "tcp_stream": 137, "udp_stream": null, "frame_number": 13385, "timestamp_epoch": "1580346261.639565000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps-api-v3/api/js/38/11/controls.js", "http.response_in": "13467", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/controls.js" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-eb02c65d8036a5232d0a4634", "src_port": 49812, "tcp_stream": 137, "udp_stream": null, "frame_number": 13407, "timestamp_epoch": "1580346261.955338000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13468", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-db40c79b53dc61026a7cf792", "src_port": 49821, "tcp_stream": 146, "udp_stream": null, "frame_number": 13409, "timestamp_epoch": "1580346261.955975000" }, { "kind": "http_request", "dst_ip": "172.217.14.170", "fields": { "http.host": "fonts.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/css?family=Roboto:300,400,500,700|Google+Sans", "http.response_in": "13476", "http.request.method": "GET", "http.request.full_uri": "http://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Google+Sans" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-2028d336a0d8c0959386bb8d", "src_port": 49788, "tcp_stream": 113, "udp_stream": null, "frame_number": 13471, "timestamp_epoch": "1580346262.041421000" }, { "kind": "http_request", "dst_ip": "172.217.2.227", "fields": { "http.host": "maps.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/mapfiles/api-3/images/google_white5.png", "http.response_in": "13481", "http.request.method": "GET", "http.request.full_uri": "http://maps.gstatic.com/mapfiles/api-3/images/google_white5.png" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-14b57f47d52ac811a1e90e56", "src_port": 49820, "tcp_stream": 145, "udp_stream": null, "frame_number": 13474, "timestamp_epoch": "1580346262.061304000" }, { "kind": "http_request", "dst_ip": "172.217.9.170", "fields": { "http.host": "maps.googleapis.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]", "http.response_in": "13503", "http.request.method": "GET", "http.request.full_uri": "http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-05d1307491164118690c7283", "src_port": 49821, "tcp_stream": 146, "udp_stream": null, "frame_number": 13477, "timestamp_epoch": "1580346262.073117000" }, { "kind": "http_request", "dst_ip": "172.217.14.163", "fields": { "http.host": "fonts.gstatic.com", "http.user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "http.request.uri": "/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2", "http.response_in": "13501", "http.request.method": "GET", "http.request.full_uri": "http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-1069feaf9263f33d43bd6410", "src_port": 49796, "tcp_stream": 121, "udp_stream": null, "frame_number": 13483, "timestamp_epoch": "1580346262.089124000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "492", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "23.51.186.146", "dst_port": 49696, "event_id": "evt-1fc58a0ca02cf495a7d2bf7f", "src_port": 80, "tcp_stream": 23, "udp_stream": null, "frame_number": 494, "timestamp_epoch": "1580345695.378299000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "506", "http.content_type": "text/xml; charset=utf-16LE", "http.response.code": "200", "http.content_length": "1728" }, "src_ip": "40.67.249.61", "dst_port": 49697, "event_id": "evt-6144dd620cc3e608dca02f19", "src_port": 80, "tcp_stream": 24, "udp_stream": null, "body_sha256": "53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d", "frame_number": 509, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1728, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1728, "timestamp_epoch": "1580345695.771487000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "520", "http.response.code": "302", "http.content_length": "0" }, "src_ip": "23.51.186.146", "dst_port": 49698, "event_id": "evt-f2eb0d28f10b4ce3805fbeae", "src_port": 80, "tcp_stream": 25, "udp_stream": null, "frame_number": 524, "timestamp_epoch": "1580345695.891724000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "531", "http.content_type": "text/xml; charset=utf-16LE", "http.response.code": "200", "http.content_length": "1734" }, "src_ip": "40.67.249.61", "dst_port": 49697, "event_id": "evt-b9fc7a4f48bc9f4d4ad9ba4c", "src_port": 80, "tcp_stream": 24, "udp_stream": null, "body_sha256": "9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37", "frame_number": 606, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1734, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1734, "timestamp_epoch": "1580345696.140205000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "1169", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "81920" }, "src_ip": "49.51.133.162", "dst_port": 49728, "event_id": "evt-f198a6f3cc51ef82fb1120d3", "src_port": 80, "tcp_stream": 55, "udp_stream": null, "body_sha256": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda", "frame_number": 1235, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 81920, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 81920, "timestamp_epoch": "1580345758.042190000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "1242", "http.content_type": "text/plain", "http.response.code": "200", "http.content_length": "15" }, "src_ip": "184.73.165.106", "dst_port": 49729, "event_id": "evt-bb1d2e9b43c22e2a1a481734", "src_port": 80, "tcp_stream": 56, "udp_stream": null, "body_sha256": "e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5", "frame_number": 1244, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 15, "timestamp_epoch": "1580345758.445237000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "1251", "http.content_type": "text/html", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "81.177.6.156", "dst_port": 49730, "event_id": "evt-8a9734ffc5edc33e137b1a89", "src_port": 80, "tcp_stream": 57, "udp_stream": null, "body_sha256": "b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00", "frame_number": 1253, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 436, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 436, "timestamp_epoch": "1580345759.043889000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "1260", "http.response.code": "200", "http.content_length": "46334" }, "src_ip": "148.66.137.40", "dst_port": 49731, "event_id": "evt-b9ce5612116f7b9f45440a05", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627", "frame_number": 1306, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 46334, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 46334, "timestamp_epoch": "1580345760.194399000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "1315", "http.content_type": "text/html", "http.response.code": "200" }, "src_ip": "81.177.6.156", "dst_port": 49732, "event_id": "evt-03aa4fa2367e676013c34c2f", "src_port": 80, "tcp_stream": 59, "udp_stream": null, "body_sha256": "fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d", "frame_number": 1317, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 20, "timestamp_epoch": "1580345761.029550000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "3430", "http.response.code": "200", "http.content_length": "47394" }, "src_ip": "148.66.137.40", "dst_port": 49731, "event_id": "evt-5015b23732cabf94340edc57", "src_port": 80, "tcp_stream": 58, "udp_stream": null, "body_sha256": "999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed", "frame_number": 3487, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 47394, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 47394, "timestamp_epoch": "1580345764.898561000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "3586", "http.content_type": "text/html", "http.response.code": "200" }, "src_ip": "81.177.6.156", "dst_port": 49736, "event_id": "evt-3c2f0114ed051bb5a714dc2b", "src_port": 80, "tcp_stream": 63, "udp_stream": null, "body_sha256": "6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c", "frame_number": 3589, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 13, "timestamp_epoch": "1580345765.577426000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "7711", "http.content_type": "text/html", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "81.177.6.156", "dst_port": 49742, "event_id": "evt-be736fd989cba8778d0ca6b3", "src_port": 80, "tcp_stream": 70, "udp_stream": null, "body_sha256": "909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e", "frame_number": 7713, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1580345885.300907000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "7823", "http.content_type": "text/html", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "81.177.6.156", "dst_port": 49748, "event_id": "evt-a37613143a1d1bb2af901050", "src_port": 80, "tcp_stream": 76, "udp_stream": null, "body_sha256": "866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72", "frame_number": 7825, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1580346005.690328000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "7916", "http.content_type": "text/html", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "81.177.6.156", "dst_port": 49752, "event_id": "evt-1181427be3599d58bc5db2cc", "src_port": 80, "tcp_stream": 80, "udp_stream": null, "body_sha256": "6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d", "frame_number": 7918, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1580346126.063592000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "8222", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "301", "http.content_length": "219" }, "src_ip": "216.58.194.46", "dst_port": 49764, "event_id": "evt-4d48d5f1b4d0c5b5e29d9968", "src_port": 80, "tcp_stream": 89, "udp_stream": null, "body_sha256": "2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de", "frame_number": 8224, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 219, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 219, "timestamp_epoch": "1580346162.763305000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "8231", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "302", "http.content_length": "231" }, "src_ip": "216.58.193.132", "dst_port": 49766, "event_id": "evt-0751d4a18da5985a20b20508", "src_port": 80, "tcp_stream": 91, "udp_stream": null, "body_sha256": "f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200", "frame_number": 8233, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 231, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 231, "timestamp_epoch": "1580346162.842756000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9913", "http.content_type": "text/html; charset=UTF-8", "http.response.code": "200", "http.content_length": "546", "http.content_encoding": "gzip" }, "src_ip": "216.58.193.132", "dst_port": 49766, "event_id": "evt-fe073cc5948b66f0f35d26ec", "src_port": 80, "tcp_stream": 91, "udp_stream": null, "body_sha256": "d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e", "frame_number": 9927, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 899, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 899, "timestamp_epoch": "1580346175.685396000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9949", "http.content_type": "text/html;charset=utf-8", "http.response.code": "200", "http.content_length": "13280", "http.content_encoding": "gzip" }, "src_ip": "198.185.159.144", "dst_port": 49781, "event_id": "evt-59bc5d696b0f3eab0952f55b", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94", "frame_number": 9963, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 54163, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 54163, "timestamp_epoch": "1580346175.975417000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9999", "http.content_type": "text/css", "http.response.code": "200", "http.content_length": "2196", "http.content_encoding": "gzip" }, "src_ip": "104.97.213.249", "dst_port": 49786, "event_id": "evt-b772fe77ad550f37941104d6", "src_port": 80, "tcp_stream": 111, "udp_stream": null, "body_sha256": "74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16", "frame_number": 10037, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 9882, "timestamp_epoch": "1580346176.026280000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9995", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "14928", "http.content_encoding": "gzip" }, "src_ip": "104.97.213.249", "dst_port": 49785, "event_id": "evt-2f2b27705899ac6f4cbc4a31", "src_port": 80, "tcp_stream": 110, "udp_stream": null, "body_sha256": "55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9", "frame_number": 10068, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 47293, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 47293, "timestamp_epoch": "1580346176.028615000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9976", "http.content_type": "text/javascript;charset=utf-8", "http.response.code": "200", "http.content_length": "7489", "http.content_encoding": "gzip" }, "src_ip": "104.81.85.107", "dst_port": 49783, "event_id": "evt-a76f6e7047af423ef6db7a81", "src_port": 80, "tcp_stream": 108, "udp_stream": null, "body_sha256": "126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e", "frame_number": 10081, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19548, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19548, "timestamp_epoch": "1580346176.032853000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "10012", "http.content_type": "image/png", "http.response.code": "301", "http.content_length": "0" }, "src_ip": "151.101.0.238", "dst_port": 49791, "event_id": "evt-8322c6154cda2b4cd7d96e98", "src_port": 80, "tcp_stream": 116, "udp_stream": null, "frame_number": 10083, "timestamp_epoch": "1580346176.034712000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "10016", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "172.217.14.170", "dst_port": 49788, "event_id": "evt-4a516efeb3c85f078ad4a1c7", "src_port": 80, "tcp_stream": 113, "udp_stream": null, "body_sha256": "05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3", "frame_number": 10196, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3803, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3803, "timestamp_epoch": "1580346176.045395000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "10010", "http.content_type": "text/css; charset=UTF-8", "http.response.code": "200", "http.content_length": "58391", "http.content_encoding": "gzip" }, "src_ip": "151.101.0.238", "dst_port": 49789, "event_id": "evt-8b137b086f6a40ff3ff3199e", "src_port": 80, "tcp_stream": 114, "udp_stream": null, "body_sha256": "6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f", "frame_number": 10246, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 542610, "timestamp_epoch": "1580346176.053445000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9993", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "342081", "http.content_encoding": "gzip" }, "src_ip": "104.97.213.249", "dst_port": 49787, "event_id": "evt-d8699109819dc8e594c0bdfc", "src_port": 80, "tcp_stream": 112, "udp_stream": null, "body_sha256": "ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db", "frame_number": 10645, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1459260, "timestamp_epoch": "1580346176.084402000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "9991", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "424648", "http.content_encoding": "gzip" }, "src_ip": "104.97.213.249", "dst_port": 49784, "event_id": "evt-e395cba9cacb4469e113284d", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b", "frame_number": 10744, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1659717, "timestamp_epoch": "1580346176.105860000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "11073", "http.content_type": "application/json", "http.response.code": "200", "http.content_length": "418", "http.content_encoding": "gzip" }, "src_ip": "198.185.159.144", "dst_port": 49782, "event_id": "evt-3c6a4a5929cbe5600d5d0607", "src_port": 80, "tcp_stream": 107, "udp_stream": null, "body_sha256": "c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443", "frame_number": 11147, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2960, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2960, "timestamp_epoch": "1580346176.942771000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "11080", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "23484" }, "src_ip": "172.217.14.163", "dst_port": 49792, "event_id": "evt-7369c8b872eca28f2950d327", "src_port": 80, "tcp_stream": 117, "udp_stream": null, "body_sha256": "c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1", "frame_number": 11148, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23484, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23484, "timestamp_epoch": "1580346176.943197000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "11111", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "22992" }, "src_ip": "172.217.14.163", "dst_port": 49795, "event_id": "evt-d6d5982777a9f87275787428", "src_port": 80, "tcp_stream": 120, "udp_stream": null, "body_sha256": "8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20", "frame_number": 11212, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22992, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 22992, "timestamp_epoch": "1580346176.959437000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "11122", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "21580" }, "src_ip": "172.217.14.163", "dst_port": 49796, "event_id": "evt-cdfdf688174720d3da380ca7", "src_port": 80, "tcp_stream": 121, "udp_stream": null, "body_sha256": "6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398", "frame_number": 11220, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21580, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 21580, "timestamp_epoch": "1580346176.960817000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "11070", "http.content_type": "application/json;charset=utf-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.144", "dst_port": 49781, "event_id": "evt-4528381df76acfd7b603227d", "src_port": 80, "tcp_stream": 106, "udp_stream": null, "body_sha256": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "frame_number": 11473, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 17, "timestamp_epoch": "1580346177.025222000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12855", "http.content_type": "text/html", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "81.177.6.156", "dst_port": 49802, "event_id": "evt-50ea3bdd68f74092369f54f1", "src_port": 80, "tcp_stream": 127, "udp_stream": null, "body_sha256": "8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36", "frame_number": 12857, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 12, "timestamp_epoch": "1580346246.475071000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12904", "http.content_type": "text/html;charset=utf-8", "http.response.code": "200", "http.content_length": "11493", "http.content_encoding": "gzip" }, "src_ip": "198.185.159.144", "dst_port": 49803, "event_id": "evt-8710f7760e65c21dea11d973", "src_port": 80, "tcp_stream": 128, "udp_stream": null, "body_sha256": "5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3", "frame_number": 12942, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 41620, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 41620, "timestamp_epoch": "1580346260.359766000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12912", "http.response.code": "204" }, "src_ip": "198.185.159.144", "dst_port": 49804, "event_id": "evt-00f24673624f83a376d71638", "src_port": 80, "tcp_stream": 129, "udp_stream": null, "frame_number": 12952, "timestamp_epoch": "1580346260.412593000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12946", "http.response.code": "204" }, "src_ip": "198.185.159.144", "dst_port": 49803, "event_id": "evt-56ead7d236a584edd045b7ee", "src_port": 80, "tcp_stream": 128, "udp_stream": null, "frame_number": 12954, "timestamp_epoch": "1580346260.508461000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12960", "http.content_type": "application/json;charset=utf-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.144", "dst_port": 49804, "event_id": "evt-1e9cfc4d0e472bb574db960b", "src_port": 80, "tcp_stream": 129, "udp_stream": null, "body_sha256": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "frame_number": 12980, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 17, "timestamp_epoch": "1580346261.183847000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12962", "http.content_type": "application/json;charset=utf-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.144", "dst_port": 49807, "event_id": "evt-f97ee1ff02fc2ecc3ab6820e", "src_port": 80, "tcp_stream": 132, "udp_stream": null, "body_sha256": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "frame_number": 12992, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 17, "timestamp_epoch": "1580346261.219547000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12979", "http.content_type": "application/json", "http.response.code": "200", "http.content_length": "417", "http.content_encoding": "gzip" }, "src_ip": "198.185.159.144", "dst_port": 49808, "event_id": "evt-77f854967e5d625f57b8d4ad", "src_port": 80, "tcp_stream": 133, "udp_stream": null, "body_sha256": "1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015", "frame_number": 13011, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2959, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2959, "timestamp_epoch": "1580346261.232398000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12989", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "38080", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49809, "event_id": "evt-a6bd6a68840659f9f3ba8f96", "src_port": 80, "tcp_stream": 134, "udp_stream": null, "body_sha256": "4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b", "frame_number": 13035, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 117672, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 117672, "timestamp_epoch": "1580346261.237901000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "12957", "http.content_type": "application/json;charset=utf-8", "http.response.code": "200", "http.transfer_encoding": "chunked" }, "src_ip": "198.185.159.144", "dst_port": 49803, "event_id": "evt-7d90312f721782a6698abc28", "src_port": 80, "tcp_stream": 128, "udp_stream": null, "body_sha256": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "frame_number": 13037, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 17, "timestamp_epoch": "1580346261.257522000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13042", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "28564", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49809, "event_id": "evt-c37090fb207feb6a4a36940a", "src_port": 80, "tcp_stream": 134, "udp_stream": null, "body_sha256": "3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50", "frame_number": 13084, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 77975, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 77975, "timestamp_epoch": "1580346261.358580000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13056", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "11505", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49811, "event_id": "evt-a85f8577230dce9ba63408e2", "src_port": 80, "tcp_stream": 136, "udp_stream": null, "body_sha256": "c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd", "frame_number": 13093, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 31427, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 31427, "timestamp_epoch": "1580346261.364830000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13054", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "16283", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49812, "event_id": "evt-92300ccfb80358bb42273116", "src_port": 80, "tcp_stream": 137, "udp_stream": null, "body_sha256": "ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf", "frame_number": 13121, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 42435, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 42435, "timestamp_epoch": "1580346261.378909000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13052", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "53979", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49810, "event_id": "evt-8bfcfcdd7d337232229b766c", "src_port": 80, "tcp_stream": 135, "udp_stream": null, "body_sha256": "f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12", "frame_number": 13163, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 146174, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 146174, "timestamp_epoch": "1580346261.393381000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13167", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "9135", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49810, "event_id": "evt-1d675685627e8a9ef4eb5c78", "src_port": 80, "tcp_stream": 135, "udp_stream": null, "body_sha256": "c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1", "frame_number": 13178, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24657, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 24657, "timestamp_epoch": "1580346261.479483000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13169", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "1711", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49812, "event_id": "evt-cad9e6838ada5745c8a5a89b", "src_port": 80, "tcp_stream": 137, "udp_stream": null, "body_sha256": "58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e", "frame_number": 13181, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3862, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3862, "timestamp_epoch": "1580346261.481061000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13191", "http.content_type": "image/bmp", "http.response.code": "200", "http.content_length": "326" }, "src_ip": "172.217.2.227", "dst_port": 49813, "event_id": "evt-3f10877bacbfd37abed263b0", "src_port": 80, "tcp_stream": 138, "udp_stream": null, "body_sha256": "7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7", "frame_number": 13225, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 326, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 326, "timestamp_epoch": "1580346261.532006000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13187", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "3113", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49810, "event_id": "evt-9112fb91bf366eed4ce0915e", "src_port": 80, "tcp_stream": 135, "udp_stream": null, "body_sha256": "0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828", "frame_number": 13228, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27756, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 27756, "timestamp_epoch": "1580346261.538532000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13203", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "19250" }, "src_ip": "172.217.2.238", "dst_port": 49814, "event_id": "evt-18cae18f26bccbaaadec257c", "src_port": 80, "tcp_stream": 139, "udp_stream": null, "body_sha256": "10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b", "frame_number": 13299, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19250, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 19250, "timestamp_epoch": "1580346261.553068000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13221", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "22721" }, "src_ip": "172.217.12.46", "dst_port": 49818, "event_id": "evt-0d6156f9724ad0e1703ae727", "src_port": 80, "tcp_stream": 143, "udp_stream": null, "body_sha256": "07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1", "frame_number": 13328, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22721, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 22721, "timestamp_epoch": "1580346261.561226000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13215", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "21039" }, "src_ip": "172.217.12.46", "dst_port": 49816, "event_id": "evt-c062aef86b0fdf088fcd2e8d", "src_port": 80, "tcp_stream": 141, "udp_stream": null, "body_sha256": "3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795", "frame_number": 13334, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21039, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 21039, "timestamp_epoch": "1580346261.562127000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13217", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "22229" }, "src_ip": "172.217.2.238", "dst_port": 49815, "event_id": "evt-361792e72bae7577fe297bde", "src_port": 80, "tcp_stream": 140, "udp_stream": null, "body_sha256": "97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6", "frame_number": 13335, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22229, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 22229, "timestamp_epoch": "1580346261.562179000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13219", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "23566" }, "src_ip": "172.217.12.46", "dst_port": 49817, "event_id": "evt-351185a51c2445bd89b3f423", "src_port": 80, "tcp_stream": 142, "udp_stream": null, "body_sha256": "5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619", "frame_number": 13336, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23566, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 23566, "timestamp_epoch": "1580346261.562188000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13223", "http.content_type": "image/jpeg", "http.response.code": "200", "http.content_length": "16902" }, "src_ip": "172.217.12.46", "dst_port": 49819, "event_id": "evt-f943e20ac16a1d8c86511beb", "src_port": 80, "tcp_stream": 144, "udp_stream": null, "body_sha256": "02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77", "frame_number": 13357, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16902, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 16902, "timestamp_epoch": "1580346261.579411000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13302", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "68" }, "src_ip": "172.217.2.227", "dst_port": 49813, "event_id": "evt-dde31ecd1e7d3aa5c267a192", "src_port": 80, "tcp_stream": 138, "udp_stream": null, "body_sha256": "fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588", "frame_number": 13359, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 68, "timestamp_epoch": "1580346261.583906000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13353", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "817" }, "src_ip": "172.217.2.227", "dst_port": 49820, "event_id": "evt-aee7bb99c8ef83b743933f2d", "src_port": 80, "tcp_stream": 145, "udp_stream": null, "body_sha256": "aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0", "frame_number": 13372, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 817, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 817, "timestamp_epoch": "1580346261.606486000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13362", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1836" }, "src_ip": "172.217.9.170", "dst_port": 49812, "event_id": "evt-27391edf462132bdc61e6ed7", "src_port": 80, "tcp_stream": 137, "udp_stream": null, "body_sha256": "a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa", "frame_number": 13383, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1836, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1836, "timestamp_epoch": "1580346261.635076000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13360", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "364" }, "src_ip": "172.217.9.170", "dst_port": 49810, "event_id": "evt-d9198644e0e99b784fc03403", "src_port": 80, "tcp_stream": 135, "udp_stream": null, "body_sha256": "93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6", "frame_number": 13387, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 364, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 364, "timestamp_epoch": "1580346261.640060000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13364", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "3227" }, "src_ip": "172.217.9.170", "dst_port": 49811, "event_id": "evt-4cdd7956f25135bcc851a1f1", "src_port": 80, "tcp_stream": 136, "udp_stream": null, "body_sha256": "3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75", "frame_number": 13390, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3227, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 3227, "timestamp_epoch": "1580346261.647062000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13366", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "2842" }, "src_ip": "172.217.9.170", "dst_port": 49809, "event_id": "evt-939f7122fc059db572355491", "src_port": 80, "tcp_stream": 134, "udp_stream": null, "body_sha256": "6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09", "frame_number": 13395, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2842, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2842, "timestamp_epoch": "1580346261.656638000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13379", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "618" }, "src_ip": "172.217.9.170", "dst_port": 49822, "event_id": "evt-07bf158635a89fe1a1047302", "src_port": 80, "tcp_stream": 147, "udp_stream": null, "body_sha256": "a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30", "frame_number": 13397, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 618, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 618, "timestamp_epoch": "1580346261.659601000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13377", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "2818" }, "src_ip": "172.217.9.170", "dst_port": 49821, "event_id": "evt-6c0556bce575d79a4a76f16e", "src_port": 80, "tcp_stream": 146, "udp_stream": null, "body_sha256": "7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55", "frame_number": 13400, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2818, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2818, "timestamp_epoch": "1580346261.664745000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13385", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "365", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49812, "event_id": "evt-8cd92a6dd762f7e371c31b58", "src_port": 80, "tcp_stream": 137, "udp_stream": null, "body_sha256": "238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88", "frame_number": 13403, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1245, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1245, "timestamp_epoch": "1580346261.692991000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13407", "http.content_type": "text/javascript", "http.response.code": "200", "http.content_length": "57507", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49812, "event_id": "evt-80a13d7e56a66ebc5463be04", "src_port": 80, "tcp_stream": 137, "udp_stream": null, "body_sha256": "29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d", "frame_number": 13467, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 213467, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 213467, "timestamp_epoch": "1580346261.986607000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13409", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "63", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49821, "event_id": "evt-e461c140cd89a7f9af94b6ad", "src_port": 80, "tcp_stream": 146, "udp_stream": null, "body_sha256": "fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774", "frame_number": 13468, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 62, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 62, "timestamp_epoch": "1580346261.991958000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13471", "http.content_type": "text/css; charset=utf-8", "http.response.code": "200", "http.content_encoding": "gzip", "http.transfer_encoding": "chunked" }, "src_ip": "172.217.14.170", "dst_port": 49788, "event_id": "evt-24372a8fbf2b728c2151ab36", "src_port": 80, "tcp_stream": 113, "udp_stream": null, "body_sha256": "277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149", "frame_number": 13476, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11036, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 11036, "timestamp_epoch": "1580346262.062551000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13474", "http.content_type": "image/png", "http.response.code": "200", "http.content_length": "1642" }, "src_ip": "172.217.2.227", "dst_port": 49820, "event_id": "evt-b33ca306cd4b5cf28808dff3", "src_port": 80, "tcp_stream": 145, "udp_stream": null, "body_sha256": "0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942", "frame_number": 13481, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1642, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1642, "timestamp_epoch": "1580346262.088484000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13483", "http.content_type": "font/woff2", "http.response.code": "200", "http.content_length": "15736" }, "src_ip": "172.217.14.163", "dst_port": 49796, "event_id": "evt-05f66bc62df7d2c3b67cd051", "src_port": 80, "tcp_stream": 121, "udp_stream": null, "body_sha256": "48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3", "frame_number": 13501, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15736, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 15736, "timestamp_epoch": "1580346262.105312000" }, { "kind": "http_response", "dst_ip": "10.20.30.227", "fields": { "http.request_in": "13477", "http.content_type": "text/javascript; charset=UTF-8", "http.response.code": "200", "http.content_length": "63", "http.content_encoding": "gzip" }, "src_ip": "172.217.9.170", "dst_port": 49821, "event_id": "evt-9527d78510729c47c97bb92f", "src_port": 80, "tcp_stream": 146, "udp_stream": null, "body_sha256": "b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e", "frame_number": 13503, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 62, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 62, "timestamp_epoch": "1580346262.108595000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "52.114.75.79", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-0ec8a9e774ac8f56b99db156", "src_port": 49711, "tcp_stream": 38, "udp_stream": null, "frame_number": 800, "timestamp_epoch": "1580345704.119816000" }, { "kind": "tls_client_hello", "dst_ip": "52.242.211.89", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-582c64334239c2cb77c32605", "src_port": 49720, "tcp_stream": 47, "udp_stream": null, "frame_number": 942, "timestamp_epoch": "1580345705.576845000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-6b12c9e107b8ef33a705e588", "src_port": 49721, "tcp_stream": 48, "udp_stream": null, "frame_number": 974, "timestamp_epoch": "1580345708.685523000" }, { "kind": "tls_client_hello", "dst_ip": "40.126.0.67", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "login.microsoftonline.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-8b3b3a5ee8850e7e39d74f18", "src_port": 49726, "tcp_stream": 53, "udp_stream": null, "frame_number": 1127, "timestamp_epoch": "1580345751.530306000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.22", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-c059356ad13d5edff23fb2e1", "src_port": 49734, "tcp_stream": 61, "udp_stream": null, "frame_number": 1398, "timestamp_epoch": "1580345761.150625000" }, { "kind": "tls_client_hello", "dst_ip": "52.242.211.89", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-0b554c088905bcf046a30d71", "src_port": 49735, "tcp_stream": 62, "udp_stream": null, "frame_number": 3471, "timestamp_epoch": "1580345764.885473000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.10", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "pti.store.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-12891f3177fad494d2685f92", "src_port": 49741, "tcp_stream": 69, "udp_stream": null, "frame_number": 7677, "timestamp_epoch": "1580345870.832298000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.76.30", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-629562cff8e86b5b27dcee31", "src_port": 49743, "tcp_stream": 71, "udp_stream": null, "frame_number": 7728, "timestamp_epoch": "1580345984.463481000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.75.79", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-b2418b6416de759d228ef738", "src_port": 49749, "tcp_stream": 77, "udp_stream": null, "frame_number": 7830, "timestamp_epoch": "1580346023.998910000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.22", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-e951af0d60eb66b6a22b28a8", "src_port": 49750, "tcp_stream": 78, "udp_stream": null, "frame_number": 7869, "timestamp_epoch": "1580346113.588301000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.22", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-ebf777faf0b81d11399d758a", "src_port": 49751, "tcp_stream": 79, "udp_stream": null, "frame_number": 7873, "timestamp_epoch": "1580346113.627817000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-ffe5a812be9b70198874a432", "src_port": 49753, "tcp_stream": 81, "udp_stream": null, "frame_number": 7952, "timestamp_epoch": "1580346136.114901000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-40045dff821ce996e364a18b", "src_port": 49759, "tcp_stream": 84, "udp_stream": null, "frame_number": 8061, "timestamp_epoch": "1580346149.625887000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.222", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "fp.msedge.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-97904ec78e276f8e8c98ecec", "src_port": 49760, "tcp_stream": 85, "udp_stream": null, "frame_number": 8091, "timestamp_epoch": "1580346151.005528000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "t-ring.msedge.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-1eb2bd3d5aec1144a7c54a60", "src_port": 49761, "tcp_stream": 86, "udp_stream": null, "frame_number": 8119, "timestamp_epoch": "1580346153.179668000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.42.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "l-ring.msedge.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-2191667911dce5ea191f6964", "src_port": 49762, "tcp_stream": 87, "udp_stream": null, "frame_number": 8149, "timestamp_epoch": "1580346153.295097000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "a-ring.msedge.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-3b27be5f20118f5cc737f2b6", "src_port": 49763, "tcp_stream": 88, "udp_stream": null, "frame_number": 8179, "timestamp_epoch": "1580346153.397126000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.132", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.google.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-fdbdb73dcb498d9b2490934d", "src_port": 49767, "tcp_stream": 92, "udp_stream": null, "frame_number": 8237, "timestamp_epoch": "1580346162.859161000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.131", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "ssl.gstatic.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-a6df55ec555d39960a59109b", "src_port": 49768, "tcp_stream": 93, "udp_stream": null, "frame_number": 8353, "timestamp_epoch": "1580346163.306491000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.163", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-c278697ca4cfc94586ddf108", "src_port": 49770, "tcp_stream": 95, "udp_stream": null, "frame_number": 8385, "timestamp_epoch": "1580346163.374824000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.163", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-e96cf22fff493cbe254762b5", "src_port": 49769, "tcp_stream": 94, "udp_stream": null, "frame_number": 8387, "timestamp_epoch": "1580346163.375214000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.9.3", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "www.gstatic.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-bd789413158c077e97d55d2b", "src_port": 49771, "tcp_stream": 96, "udp_stream": null, "frame_number": 8433, "timestamp_epoch": "1580346163.421483000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.6.158", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "edge.microsoft.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-f251db4b119f14942c5b475c", "src_port": 49772, "tcp_stream": 97, "udp_stream": null, "frame_number": 8591, "timestamp_epoch": "1580346163.451141000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.238", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "apis.google.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-e6d72d836f02e2cabb131b2a", "src_port": 49773, "tcp_stream": 98, "udp_stream": null, "frame_number": 8776, "timestamp_epoch": "1580346163.942156000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.1.238", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "ogs.google.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-9c48a062e705ac4d343f3909", "src_port": 49774, "tcp_stream": 99, "udp_stream": null, "frame_number": 8853, "timestamp_epoch": "1580346164.035709000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "adservice.google.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-9f10585661080b70b9011a90", "src_port": 49775, "tcp_stream": 100, "udp_stream": null, "frame_number": 8903, "timestamp_epoch": "1580346164.206635000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.193.130", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "googleads.g.doubleclick.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-068628149ee084e25ce9a422", "src_port": 49776, "tcp_stream": 101, "udp_stream": null, "frame_number": 8928, "timestamp_epoch": "1580346164.322115000" }, { "kind": "tls_client_hello", "dst_ip": "216.58.194.78", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "play.google.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-cef13837d71eeb4005c4f3ba", "src_port": 49777, "tcp_stream": 102, "udp_stream": null, "frame_number": 8974, "timestamp_epoch": "1580346164.956726000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.14.163", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "fonts.gstatic.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-1c95fb79358403c344c98fc6", "src_port": 49778, "tcp_stream": 103, "udp_stream": null, "frame_number": 9223, "timestamp_epoch": "1580346172.209981000" }, { "kind": "tls_client_hello", "dst_ip": "172.217.9.1", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "lh5.googleusercontent.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-7b78ba89a74d63dbe8ef4204", "src_port": 49779, "tcp_stream": 104, "udp_stream": null, "frame_number": 9332, "timestamp_epoch": "1580346173.092854000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.238", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "static1.squarespace.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-dcd7ce5a98089835b948f895", "src_port": 49790, "tcp_stream": 115, "udp_stream": null, "frame_number": 10008, "timestamp_epoch": "1580346176.019853000" }, { "kind": "tls_client_hello", "dst_ip": "151.101.0.238", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "images.squarespace-cdn.com" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-98765467d963f20b73c6a54b", "src_port": 49793, "tcp_stream": 118, "udp_stream": null, "frame_number": 10750, "timestamp_epoch": "1580346176.136362000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-abb82b22958aa4b0485f595f", "src_port": 49794, "tcp_stream": 119, "udp_stream": null, "frame_number": 11116, "timestamp_epoch": "1580346176.933425000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-4b8253cc4521d5f4569aa2e5", "src_port": 49797, "tcp_stream": 122, "udp_stream": null, "frame_number": 11119, "timestamp_epoch": "1580346176.933874000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-733de9ffaaee29fc74b82b6c", "src_port": 49798, "tcp_stream": 123, "udp_stream": null, "frame_number": 11125, "timestamp_epoch": "1580346176.934528000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-97516032f5419727e3c03dbd", "src_port": 49799, "tcp_stream": 124, "udp_stream": null, "frame_number": 11131, "timestamp_epoch": "1580346176.936624000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-3b4d73eaec6245af78711a80", "src_port": 49800, "tcp_stream": 125, "udp_stream": null, "frame_number": 11135, "timestamp_epoch": "1580346176.937865000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "p.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-d7459edc93c7683ac8730e23", "src_port": 49801, "tcp_stream": 126, "udp_stream": null, "frame_number": 12038, "timestamp_epoch": "1580346177.193732000" }, { "kind": "tls_client_hello", "dst_ip": "104.81.85.107", "fields": { "tls.handshake.ja3": "66918128f1b9b03303d77c6f2eefd128", "tls.handshake.extensions_server_name": "use.typekit.net" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-2e7bc80948d1bda75140e50e", "src_port": 49805, "tcp_stream": 130, "udp_stream": null, "frame_number": 12916, "timestamp_epoch": "1580346260.316460000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-dc95448d5eb647590d4e7c44", "src_port": 49684, "tcp_stream": 13, "udp_stream": null, "frame_number": 1041, "timestamp_epoch": "1580345733.973511000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-f2ec179d7b91a05b467d936d", "src_port": 49684, "tcp_stream": 13, "udp_stream": null, "frame_number": 3428, "timestamp_epoch": "1580345763.979818000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-1b241b7c10e660bac48afc8f", "src_port": 49715, "tcp_stream": 42, "udp_stream": null, "frame_number": 7615, "timestamp_epoch": "1580345777.700045000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-01538d5db03d7c20fe64fb8f", "src_port": 49684, "tcp_stream": 13, "udp_stream": null, "frame_number": 7617, "timestamp_epoch": "1580345793.982232000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-b5c97b153a0e8a16e0549c68", "src_port": 49715, "tcp_stream": 42, "udp_stream": null, "frame_number": 7619, "timestamp_epoch": "1580345807.716260000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-75ed0936a77fb6b84ca7e467", "src_port": 49684, "tcp_stream": 13, "udp_stream": null, "frame_number": 7636, "timestamp_epoch": "1580345823.997821000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.2", "dst_port": 49684, "event_id": "evt-801f84fe7bf6a43974a02814", "src_port": 445, "tcp_stream": 13, "udp_stream": null, "frame_number": 7638, "timestamp_epoch": "1580345824.020258000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.2", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 445, "event_id": "evt-75d035246254996574000982", "src_port": 49684, "tcp_stream": 13, "udp_stream": null, "frame_number": 7643, "timestamp_epoch": "1580345853.999623000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.2", "dst_port": 49715, "event_id": "evt-21b503e3a53ea3b4f90921bd", "src_port": 445, "tcp_stream": 42, "udp_stream": null, "frame_number": 7660, "timestamp_epoch": "1580345867.741110000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.2", "dst_port": 49715, "event_id": "evt-a01cd85bdeebac07fe21ec2a", "src_port": 445, "tcp_stream": 42, "udp_stream": null, "frame_number": 7743, "timestamp_epoch": "1580345987.757605000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.2", "dst_port": 49715, "event_id": "evt-9775077aea6d7b4680222d55", "src_port": 445, "tcp_stream": 42, "udp_stream": null, "frame_number": 7863, "timestamp_epoch": "1580346107.789860000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.3.128", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-7bb126061c7bf73cc5e84803", "src_port": 49753, "tcp_stream": 81, "udp_stream": null, "frame_number": 12805, "timestamp_epoch": "1580346181.341781000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-1c2f169fb64b9806ac099584", "src_port": 49764, "tcp_stream": 89, "udp_stream": null, "frame_number": 12815, "timestamp_epoch": "1580346207.764979000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-70c5e78902694d027b9b3fda", "src_port": 49768, "tcp_stream": 93, "udp_stream": null, "frame_number": 12816, "timestamp_epoch": "1580346208.374466000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-ca376c3d2e4c4715bf20129f", "src_port": 49770, "tcp_stream": 95, "udp_stream": null, "frame_number": 12817, "timestamp_epoch": "1580346208.467746000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.6.158", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-8df4ef8232436f30534e21ea", "src_port": 49772, "tcp_stream": 97, "udp_stream": null, "frame_number": 12818, "timestamp_epoch": "1580346208.561878000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.1.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-ae5bf1a062830db05aca07dd", "src_port": 49773, "tcp_stream": 98, "udp_stream": null, "frame_number": 12819, "timestamp_epoch": "1580346209.014683000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.1.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-2df9f932abacd24be56877eb", "src_port": 49774, "tcp_stream": 99, "udp_stream": null, "frame_number": 12820, "timestamp_epoch": "1580346209.139976000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.130", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-16be17032cf2a865377c89ec", "src_port": 49775, "tcp_stream": 100, "udp_stream": null, "frame_number": 12821, "timestamp_epoch": "1580346209.436585000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.78", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-f43ccb350a4d43bab5eb72e3", "src_port": 49777, "tcp_stream": 102, "udp_stream": null, "frame_number": 12822, "timestamp_epoch": "1580346210.030969000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-c125d83e595ac746736cf6ae", "src_port": 49778, "tcp_stream": 103, "udp_stream": null, "frame_number": 12827, "timestamp_epoch": "1580346217.249580000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.9.3", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-8f7aa9d749a749370528fa27", "src_port": 49771, "tcp_stream": 96, "udp_stream": null, "frame_number": 12828, "timestamp_epoch": "1580346218.608952000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.9.1", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-b9b10d508984b6eb8926c887", "src_port": 49779, "tcp_stream": 104, "udp_stream": null, "frame_number": 12829, "timestamp_epoch": "1580346219.437253000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.130", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-8cdc9e629603ab0aa5f241d7", "src_port": 49776, "tcp_stream": 101, "udp_stream": null, "frame_number": 12830, "timestamp_epoch": "1580346219.577411000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.132", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-a8ef30b19afa74a94d8cea9f", "src_port": 49780, "tcp_stream": 105, "udp_stream": null, "frame_number": 12831, "timestamp_epoch": "1580346220.656304000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.132", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-39e983a15b0ee84629069328", "src_port": 49766, "tcp_stream": 91, "udp_stream": null, "frame_number": 12832, "timestamp_epoch": "1580346220.687180000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.132", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-01a5fb67730b8a28e15bfb3b", "src_port": 49767, "tcp_stream": 92, "udp_stream": null, "frame_number": 12833, "timestamp_epoch": "1580346220.858320000" }, { "kind": "unclassified_tcp", "dst_ip": "104.97.213.249", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-8bd446acb4f37bd3f1dd56e9", "src_port": 49786, "tcp_stream": 111, "udp_stream": null, "frame_number": 12834, "timestamp_epoch": "1580346221.030901000" }, { "kind": "unclassified_tcp", "dst_ip": "104.97.213.249", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-55e474f6473c23ccd89c3645", "src_port": 49785, "tcp_stream": 110, "udp_stream": null, "frame_number": 12835, "timestamp_epoch": "1580346221.030985000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.0.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-61390747d4cb0c62b27ef121", "src_port": 49791, "tcp_stream": 116, "udp_stream": null, "frame_number": 12836, "timestamp_epoch": "1580346221.061452000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.170", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-b9237e04f0f7e4bbf7ce9b28", "src_port": 49788, "tcp_stream": 113, "udp_stream": null, "frame_number": 12837, "timestamp_epoch": "1580346221.061540000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.0.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-151d4e388c6ad040cd62a928", "src_port": 49789, "tcp_stream": 114, "udp_stream": null, "frame_number": 12838, "timestamp_epoch": "1580346221.061597000" }, { "kind": "unclassified_tcp", "dst_ip": "104.81.85.107", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-78c75715433ca7732c6a4811", "src_port": 49783, "tcp_stream": 108, "udp_stream": null, "frame_number": 12839, "timestamp_epoch": "1580346221.061641000" }, { "kind": "unclassified_tcp", "dst_ip": "104.97.213.249", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-a4ab8177a199be97cfb4a59d", "src_port": 49787, "tcp_stream": 112, "udp_stream": null, "frame_number": 12840, "timestamp_epoch": "1580346221.093101000" }, { "kind": "unclassified_tcp", "dst_ip": "104.97.213.249", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-1d4b652e2234306383423592", "src_port": 49784, "tcp_stream": 109, "udp_stream": null, "frame_number": 12841, "timestamp_epoch": "1580346221.109040000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.0.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-0a52e117847758a4523ff363", "src_port": 49790, "tcp_stream": 115, "udp_stream": null, "frame_number": 12842, "timestamp_epoch": "1580346221.921147000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-8deebdb82a2c6e1c62a455a7", "src_port": 49792, "tcp_stream": 117, "udp_stream": null, "frame_number": 12843, "timestamp_epoch": "1580346221.952679000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-ce1067dd23315a2c3345d0b9", "src_port": 49795, "tcp_stream": 120, "udp_stream": null, "frame_number": 12844, "timestamp_epoch": "1580346221.968851000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-81ffe9adf7b16a04f1701ae4", "src_port": 49796, "tcp_stream": 121, "udp_stream": null, "frame_number": 12845, "timestamp_epoch": "1580346221.968911000" }, { "kind": "unclassified_tcp", "dst_ip": "104.81.85.107", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-bcfb6aeffc5e68e114998236", "src_port": 49801, "tcp_stream": 126, "udp_stream": null, "frame_number": 12846, "timestamp_epoch": "1580346222.249523000" }, { "kind": "unclassified_tcp", "dst_ip": "151.101.0.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-9a4a8534acefad2dd98ca387", "src_port": 49793, "tcp_stream": 118, "udp_stream": null, "frame_number": 12847, "timestamp_epoch": "1580346222.530780000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.3.128", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-81f5d7940bdc524149636ff4", "src_port": 49753, "tcp_stream": 81, "udp_stream": null, "frame_number": 12848, "timestamp_epoch": "1580346226.343390000" }, { "kind": "unclassified_tcp", "dst_ip": "10.20.30.227", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.2", "dst_port": 49715, "event_id": "evt-94a73caeaa3df13ebd1e0649", "src_port": 445, "tcp_stream": 42, "udp_stream": null, "frame_number": 12850, "timestamp_epoch": "1580346227.807651000" }, { "kind": "unclassified_tcp", "dst_ip": "198.185.159.144", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-872173df217391959ce25096", "src_port": 49782, "tcp_stream": 107, "udp_stream": null, "frame_number": 12859, "timestamp_epoch": "1580346251.953878000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.46", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 80, "event_id": "evt-5301434448158e72bfb90ad4", "src_port": 49764, "tcp_stream": 89, "udp_stream": null, "frame_number": 12861, "timestamp_epoch": "1580346252.766319000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.131", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-60d4fdc719f5821acd43f7c1", "src_port": 49768, "tcp_stream": 93, "udp_stream": null, "frame_number": 12863, "timestamp_epoch": "1580346253.390619000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.14.163", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-58c8bfaa48171fded1fecd82", "src_port": 49770, "tcp_stream": 95, "udp_stream": null, "frame_number": 12865, "timestamp_epoch": "1580346253.469414000" }, { "kind": "unclassified_tcp", "dst_ip": "13.107.6.158", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-484656bd6e5103e71c0d9b85", "src_port": 49772, "tcp_stream": 97, "udp_stream": null, "frame_number": 12868, "timestamp_epoch": "1580346253.578398000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.1.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-68ba469e4e371dd830204725", "src_port": 49773, "tcp_stream": 98, "udp_stream": null, "frame_number": 12870, "timestamp_epoch": "1580346254.015882000" }, { "kind": "unclassified_tcp", "dst_ip": "172.217.1.238", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-f760ca10128b98a28265f377", "src_port": 49774, "tcp_stream": 99, "udp_stream": null, "frame_number": 12872, "timestamp_epoch": "1580346254.141509000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.193.130", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-53e188b04a246551f5e17411", "src_port": 49775, "tcp_stream": 100, "udp_stream": null, "frame_number": 12874, "timestamp_epoch": "1580346254.453661000" }, { "kind": "unclassified_tcp", "dst_ip": "216.58.194.78", "fields": { "tcp.payload": "00" }, "src_ip": "10.20.30.227", "dst_port": 443, "event_id": "evt-ac6c6878636266130048fc02", "src_port": 49777, "tcp_stream": 102, "udp_stream": null, "frame_number": 12877, "timestamp_epoch": "1580346255.031820000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c1e828f4fd1c02fc9b9372bc", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 59, "timestamp_epoch": "1580345692.819672000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-faa8fc3b7608ada53096ff5a", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 61, "timestamp_epoch": "1580345692.820060000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a3fa7ccecc1297f81609a254", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 117, "timestamp_epoch": "1580345692.848856000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8caa331fc4fef395cb543773", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 121, "timestamp_epoch": "1580345692.850208000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-aec42618e437f935c9705b83", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 129, "timestamp_epoch": "1580345692.852073000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-2acc398d3e18841e2655aa37", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 130, "timestamp_epoch": "1580345692.852541000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a09c2a36956dcd0e75bdbc2a", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 133, "timestamp_epoch": "1580345692.855008000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4fa72af1248cf622a87d9a08", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1580345692.855690000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0f78f41b9411ea4691e87e0c", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 136, "timestamp_epoch": "1580345692.855710000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-91dba42daab12b73c2bb4363", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 137, "timestamp_epoch": "1580345692.856017000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b1e3afd7bbfdafa32212a10b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 138, "timestamp_epoch": "1580345692.856815000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8bf8a6be95d415288b13bfe4", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 139, "timestamp_epoch": "1580345692.857566000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-702a8b83d7f02f20cca21443", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 140, "timestamp_epoch": "1580345692.857872000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0fcc19ffbfeebff529a44b6c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 141, "timestamp_epoch": "1580345692.858467000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4453f0693a079cdbefc43849", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 151, "timestamp_epoch": "1580345692.865852000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-d91007cca7fb14dae66ef418", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 152, "timestamp_epoch": "1580345692.866461000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-07e880691bcc17dc93875868", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 153, "timestamp_epoch": "1580345692.868324000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "30" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-135e07c94431014a20ce8ddc", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 154, "timestamp_epoch": "1580345692.869352000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-527888f7d29d3038f12d79b3", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 155, "timestamp_epoch": "1580345692.871126000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a00b3f2917b674b008afba36", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 156, "timestamp_epoch": "1580345692.871496000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-061396f12249f51ad7a43cbe", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 168, "timestamp_epoch": "1580345693.005437000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-2128beab8b5a4796be3c339a", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1580345693.005854000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-77cf673a5a00cf0123bebbec", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 181, "timestamp_epoch": "1580345693.208499000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c6ed4c89a39e256f71fcd9f0", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 184, "timestamp_epoch": "1580345693.208817000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-653c6ccc6b295222f9f0cb10", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 238, "timestamp_epoch": "1580345693.318150000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-50ab3d4b45e9ac416cf7a0b2", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 240, "timestamp_epoch": "1580345693.318510000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e989416b5795c359749521b2", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1580345693.319724000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7decdfacfd13acfc545935a5", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1580345693.320073000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-82ba2326e4a1a90d8c532d68", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1580345693.321106000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": {}, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ab38d9b4c1784b1491691682", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1580345693.321361000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": {}, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-99a04941e58225de33874e12", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 251, "timestamp_epoch": "1580345693.321582000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8eadbf6a62a1cb4f174dcb3e", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 266, "timestamp_epoch": "1580345693.509753000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-89563fcfd70c8a7d93367b6b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 267, "timestamp_epoch": "1580345693.509983000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4eb30297e748cbc39bc58f38", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 268, "timestamp_epoch": "1580345693.510223000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b7a6d973b4b574fcf6cf0afa", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 269, "timestamp_epoch": "1580345693.510518000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-59b5d9e264a92895fb31766b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 270, "timestamp_epoch": "1580345693.510773000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b6e513cb0dab9361b88d4f1d", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 271, "timestamp_epoch": "1580345693.510986000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d807962bae5e8e1aabb7772f", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 272, "timestamp_epoch": "1580345693.511204000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c77e448667d3c45248dee834", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 273, "timestamp_epoch": "1580345693.511346000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e37c528244560c08836e8a42", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 284, "timestamp_epoch": "1580345694.043967000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a21d797b5acad3191d658b70", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 286, "timestamp_epoch": "1580345694.044281000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-51cbe57b610b450572811dbf", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 289, "timestamp_epoch": "1580345694.046060000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-91723efcc77cd8fabed4d05e", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1580345694.046938000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-00a2c2e09cb98a1c90fb994d", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 305, "timestamp_epoch": "1580345694.087195000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-283355810d80c79c358a71a6", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 306, "timestamp_epoch": "1580345694.087635000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4a68bf04ed03f244d4985e7f", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 311, "timestamp_epoch": "1580345694.104168000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ca33937172f6f61e7973e9c0", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 313, "timestamp_epoch": "1580345694.104991000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ea36d8e2b94b4debc0ed9950", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 314, "timestamp_epoch": "1580345694.105605000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-45b6d911c034578ae86a0637", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 315, "timestamp_epoch": "1580345694.105778000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-fd7917336da3da07436a54be", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1580345694.106037000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c7677befc7f898d7d942af27", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 317, "timestamp_epoch": "1580345694.106259000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-39ba56a410c922374aeaedbf", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 318, "timestamp_epoch": "1580345694.107020000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1ede054951ebd2c21db9704e", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 319, "timestamp_epoch": "1580345694.107469000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-85745f3dd988c3379791441a", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 467, "timestamp_epoch": "1580345694.349904000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4c3344203562139ce2b731e5", "src_port": null, "tcp_stream": 18, "udp_stream": null, "frame_number": 474, "timestamp_epoch": "1580345694.421930000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-899757fea91967bd1a733f8f", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 550, "timestamp_epoch": "1580345695.929186000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0fb05ed3aef4a299091b74b6", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 551, "timestamp_epoch": "1580345695.929394000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3af37e1a8df29e559766e44b", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 552, "timestamp_epoch": "1580345695.929718000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f78396d5759e6255bdeee221", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 553, "timestamp_epoch": "1580345695.930024000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ab456d28b98a716a199a394e", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 554, "timestamp_epoch": "1580345695.930249000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-35a2aa24f777bb6e202052fc", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 555, "timestamp_epoch": "1580345695.930391000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2c5662433a5eab777d30c43e", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 558, "timestamp_epoch": "1580345695.931479000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e25789e8630183ff13b2fc00", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 559, "timestamp_epoch": "1580345695.931646000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e576309087fbf77b593cc94e", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 560, "timestamp_epoch": "1580345695.931882000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-346cb26ddb005688b81e8930", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 561, "timestamp_epoch": "1580345695.932134000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3ab572433d5e606da38a0a7a", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 562, "timestamp_epoch": "1580345695.932348000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bbf09ed533a9f2ec8b8d4359", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 563, "timestamp_epoch": "1580345695.932493000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-dcc5694e7952ecbc4b0bdff0", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 567, "timestamp_epoch": "1580345695.934942000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-14186462e909434cb09a788d", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 569, "timestamp_epoch": "1580345695.935224000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-89b157eae0ec2c656c5c60cd", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 572, "timestamp_epoch": "1580345695.937083000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-68410773e829531e5b9a8dd4", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1580345695.937699000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b4561337cba2908ad70b9e56", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 575, "timestamp_epoch": "1580345695.938647000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-fc58b214c0cebe1ad5fb7c8b", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 576, "timestamp_epoch": "1580345695.938900000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d5c00b5bd996f7ff1163458f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 577, "timestamp_epoch": "1580345695.939206000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-846579ba46b0b13e4259ed2f", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 578, "timestamp_epoch": "1580345695.939415000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-08923b443f4f7c47a3fb627d", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1580345695.939636000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b3b1f116abb164f01d619366", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1580345695.939839000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f87750561d8aa657acce8af2", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 585, "timestamp_epoch": "1580345695.942425000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7eb78eb358debbc09604912d", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 587, "timestamp_epoch": "1580345695.943044000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-977261d9503ab63169b19b83", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 588, "timestamp_epoch": "1580345695.943382000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5fa4f0779aaf13d428d1548f", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 591, "timestamp_epoch": "1580345695.943655000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-71b925c209e63689e79240a5", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 593, "timestamp_epoch": "1580345695.944121000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-da3d8f1dcbfb140a64a0fd63", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 594, "timestamp_epoch": "1580345695.944348000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0ee8effb3c6e87f0295a1634", "src_port": null, "tcp_stream": 29, "udp_stream": null, "frame_number": 595, "timestamp_epoch": "1580345695.944580000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b2145c118c3fc48f02eac02a", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 598, "timestamp_epoch": "1580345695.944766000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6681da43cd2d02393ea6dd86", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 626, "timestamp_epoch": "1580345700.677736000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-823021d1432341a8363e5a91", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 628, "timestamp_epoch": "1580345700.678066000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-95509249b8d1470ed38d1042", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 631, "timestamp_epoch": "1580345700.679007000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-d8b3d733f230da05da7edcb9", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 633, "timestamp_epoch": "1580345700.679712000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9fe587bd9be2ddda77bc9571", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 634, "timestamp_epoch": "1580345700.681675000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-528bf9a93356b3261d5ec175", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 635, "timestamp_epoch": "1580345700.681840000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4601d98aff3d2234f48cf850", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 636, "timestamp_epoch": "1580345700.682096000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b780f4e137068a0f1791dbd0", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1580345700.682289000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=SOL-LIGHTNET-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6d6fe7e916061324aa35ba3b", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 638, "timestamp_epoch": "1580345700.682535000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0066a9de1bc846b32ca2cd4a", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 639, "timestamp_epoch": "1580345700.682757000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-aeb897dfe7c4831f4e26a617", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 640, "timestamp_epoch": "1580345700.683004000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-520592e72b19425ded77b365", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 641, "timestamp_epoch": "1580345700.683209000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a4ff3676877433cd74586384", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 642, "timestamp_epoch": "1580345700.683496000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-db487eccd65330b10267e279", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1580345700.683710000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1435b578cd190dcd993c264b", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1580345700.809240000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-88f9f800672b3ae3c43ec7d2", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1580345700.810342000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e20869a5f75a6810f3344e99", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 654, "timestamp_epoch": "1580345700.811842000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-619f78bda54f3053c4670e4f", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 655, "timestamp_epoch": "1580345700.812276000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0cc84f321355d8d529cc89fe", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 686, "timestamp_epoch": "1580345700.828653000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ff8d540d3eb5f5d673e3b5d9", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 687, "timestamp_epoch": "1580345700.829357000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-84132c2f331fe727b4789338", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 688, "timestamp_epoch": "1580345700.831593000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8352bf0e7e55ec78f9817df1", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 690, "timestamp_epoch": "1580345700.837595000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c326202c7bc5d735da59d8d3", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 755, "timestamp_epoch": "1580345703.964048000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e0a982e9155f159f8707e6f1", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 756, "timestamp_epoch": "1580345703.964462000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1bce9eca9382e6baeae92754", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 757, "timestamp_epoch": "1580345703.964999000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ba1e7908e673624d6f0d9a09", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 758, "timestamp_epoch": "1580345703.965690000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f6dba554623ca980ead06141", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 759, "timestamp_epoch": "1580345703.966064000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-1a7bb72ceea154b3beac206c", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 760, "timestamp_epoch": "1580345703.966638000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1607a040f8809bd939e70357", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 761, "timestamp_epoch": "1580345703.967301000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-04d5f79837d0f7aa911323f6", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 762, "timestamp_epoch": "1580345703.967527000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "64" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-bc09aa7f4170e88928d261d8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 806, "timestamp_epoch": "1580345704.162960000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "64" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5ef3d439811d45089fe299d7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 807, "timestamp_epoch": "1580345704.163467000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "6" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-861d5758f2e8aa7a8ce687c7", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 808, "timestamp_epoch": "1580345704.164228000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "6" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-d36e2deb5d03ff114a7e76f4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 809, "timestamp_epoch": "1580345704.164464000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "5" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ba0a07d7767f54ca5b2cd5f2", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 810, "timestamp_epoch": "1580345704.164864000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-29d525bcdad34a10e6e6514f", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 811, "timestamp_epoch": "1580345704.165107000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "7" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-81062989c498daa0dfa11cb6", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 812, "timestamp_epoch": "1580345704.165665000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "7" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8b47679e29eadd81b102e638", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 813, "timestamp_epoch": "1580345704.166052000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "7" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-52bf663077325c740ebad2a9", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 814, "timestamp_epoch": "1580345704.167573000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "7" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-eac527ea840e537d09eb6c24", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 815, "timestamp_epoch": "1580345704.167925000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "17" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a7679da4261eb5b681103e7e", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 816, "timestamp_epoch": "1580345704.169477000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "17" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ca86408a261d3cbe342be1e4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 817, "timestamp_epoch": "1580345704.170054000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "34" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f77b549d8ceb573452b682d8", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 818, "timestamp_epoch": "1580345704.170618000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "34" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-d9f556bd47bf69f3a83a1237", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 819, "timestamp_epoch": "1580345704.171079000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "36" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-12267098b61c40156ee71311", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 820, "timestamp_epoch": "1580345704.171814000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Alejandrina Hogue", "samr.samr_UserInfo21.account_name": "alejandrina.hogue" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0ae8475e1549f1d20b1f5b4a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 821, "timestamp_epoch": "1580345704.172301000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-eafed86fafff8b51c1fe42cf", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 822, "timestamp_epoch": "1580345704.172479000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "3" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7004a4c6e4e00425757e8d8a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 823, "timestamp_epoch": "1580345704.174805000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "39" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-8fa0b43dd205a2726b059d5d", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 824, "timestamp_epoch": "1580345704.175103000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "39" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7bf6d9ea48e74364369d14f4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 825, "timestamp_epoch": "1580345704.175617000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "16" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-989e687258551be37f38e392", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 826, "timestamp_epoch": "1580345704.175953000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "16" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-50d733bf0404a7563c7f93d4", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 827, "timestamp_epoch": "1580345704.176484000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1d7d0c1e7d3825f54f132efe", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 828, "timestamp_epoch": "1580345704.178212000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-71d7633962656a61a53be4e5", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 829, "timestamp_epoch": "1580345704.178491000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-cd10d92e92ac6ea804110b73", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 830, "timestamp_epoch": "1580345704.178948000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-a97fdd0aa0528988bc735d9b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 831, "timestamp_epoch": "1580345704.179228000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4cb047198b33e6a19501ff7a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1580345704.179566000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-6d14983e058714a1c0223d4b", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 833, "timestamp_epoch": "1580345704.179939000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7efa76d9ae1af2dd7587dc5a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 834, "timestamp_epoch": "1580345704.180212000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "samr.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-7d4511499dcc0cdf9c3dbc9a", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 835, "timestamp_epoch": "1580345704.180505000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ef69b18cc9d60b53ef359ea7", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 894, "timestamp_epoch": "1580345704.329209000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ce2551b6f8b91b6c04acd29c", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 896, "timestamp_epoch": "1580345704.330187000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ddf803fc21fd7ddadbf25300", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 897, "timestamp_epoch": "1580345704.336734000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bce51aa4f7d759c839183804", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 898, "timestamp_epoch": "1580345704.337118000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-45cdcab815cb39b11c2025aa", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 903, "timestamp_epoch": "1580345704.355249000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-43f73d461d66b897fc089d36", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 905, "timestamp_epoch": "1580345704.356166000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e248b6185e0da8d8e02bd9b7", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 906, "timestamp_epoch": "1580345704.359064000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b688ee509b907431ceda9b68", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 907, "timestamp_epoch": "1580345704.359341000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c9763a8f0540f0385c497147", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 908, "timestamp_epoch": "1580345704.359776000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8436904f4d8ad9ac33c39d68", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 909, "timestamp_epoch": "1580345704.360141000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-7a44e802354d60f233c6fef9", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 910, "timestamp_epoch": "1580345704.360519000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e5345e60f875cd871f035f2c", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 911, "timestamp_epoch": "1580345704.361024000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-63e7ffce06d57f8c45ca4b1e", "src_port": null, "tcp_stream": 46, "udp_stream": null, "frame_number": 927, "timestamp_epoch": "1580345704.689438000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-cbab4922e90b3344f4bca660", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 931, "timestamp_epoch": "1580345704.694901000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-dcea22eaebd1355876135b1e", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1067, "timestamp_epoch": "1580345751.400902000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-fabf4376499980e82485c719", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1068, "timestamp_epoch": "1580345751.401185000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-83afa38e05a96e72b0b3da24", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1069, "timestamp_epoch": "1580345751.401693000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-cc462a66a37a686d0198e98e", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1070, "timestamp_epoch": "1580345751.402072000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2c62409eba9c06a8666232bb", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1071, "timestamp_epoch": "1580345751.402486000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-fc973f95e620c7341f89fdaf", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1072, "timestamp_epoch": "1580345751.402704000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-dc09cf755008d0a54bf50b9f", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1075, "timestamp_epoch": "1580345751.405445000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-54f125e1e1548f84b90d2a69", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1076, "timestamp_epoch": "1580345751.405678000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-58b9a129256074793ea1a038", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1077, "timestamp_epoch": "1580345751.405993000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0cce220edc517724a8cf94cc", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1078, "timestamp_epoch": "1580345751.406353000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ea346a60223b57f5e385d003", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1079, "timestamp_epoch": "1580345751.406545000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e995311fece164c94dbf67a6", "src_port": null, "tcp_stream": 50, "udp_stream": null, "frame_number": 1080, "timestamp_epoch": "1580345751.406726000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-5f26bc94a42aa326cbd38983", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1084, "timestamp_epoch": "1580345751.410809000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-f1c7b55679543c823252d01e", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1086, "timestamp_epoch": "1580345751.411190000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-736ae7b09889a0e3ef25a998", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1089, "timestamp_epoch": "1580345751.413193000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-765968f75ff490095ff9c6ab", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1091, "timestamp_epoch": "1580345751.414003000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6bd282487fe4d12a1aaa33a1", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1092, "timestamp_epoch": "1580345751.414429000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4f1808ff4849e3e7caa36dd1", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1093, "timestamp_epoch": "1580345751.414743000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2e5242440d69968a092da97a", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1094, "timestamp_epoch": "1580345751.415111000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-ca6a90a66010dad7a9f1a493", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1095, "timestamp_epoch": "1580345751.415415000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-095f52fecb8238259158747c", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1096, "timestamp_epoch": "1580345751.415660000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-11fd6e8afa21ace7cf593bd3", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1097, "timestamp_epoch": "1580345751.415917000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b12c0a9bd1a82bae0a41736d", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1102, "timestamp_epoch": "1580345751.422577000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-54938faf89f11f0d6b0ce714", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1104, "timestamp_epoch": "1580345751.423365000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-95a9e43ec73d429a5f9cc4c9", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1105, "timestamp_epoch": "1580345751.423871000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-3667532a1c765f0b5b14508c", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1108, "timestamp_epoch": "1580345751.424193000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-611cd8919354c43fd20fc1d3", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1110, "timestamp_epoch": "1580345751.424523000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-87fc4b3ad9de3448a9f80e27", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1111, "timestamp_epoch": "1580345751.424803000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ff827f0442e632e02850f0f2", "src_port": null, "tcp_stream": 52, "udp_stream": null, "frame_number": 1112, "timestamp_epoch": "1580345751.424996000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-856cb88129f1823b9884cae0", "src_port": null, "tcp_stream": 51, "udp_stream": null, "frame_number": 1115, "timestamp_epoch": "1580345751.425366000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-98ceb4499ec30222571ae548", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1152, "timestamp_epoch": "1580345753.459820000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b123825ced04b894f65684f4", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1154, "timestamp_epoch": "1580345753.460189000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9dc2e0faeed8d5b2a4b7e9ed", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1157, "timestamp_epoch": "1580345753.465765000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-320393a3ca8189d531e6e3ca", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1159, "timestamp_epoch": "1580345753.466606000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-dc786affa780b1d792a163b3", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1160, "timestamp_epoch": "1580345753.484579000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-5a7bfc6a9acd3abe75dd1803", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1161, "timestamp_epoch": "1580345753.485586000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-3c8c4b35abc5359d1b141f14", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1162, "timestamp_epoch": "1580345753.494949000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-da919f160fd8b2f5483c12ec", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3521, "timestamp_epoch": "1580345765.016333000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-155a5a835f3cbc900f82a323", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3522, "timestamp_epoch": "1580345765.016581000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-897671d9c99398ae8b0a6d10", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3523, "timestamp_epoch": "1580345765.017012000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-51dfd733ee844c50b485be2c", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3524, "timestamp_epoch": "1580345765.017378000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-ef1236b2b5213fc11f60263b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3525, "timestamp_epoch": "1580345765.017636000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-77ea42830c23b94a2d2e1962", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3526, "timestamp_epoch": "1580345765.017851000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4c6b8936e186caa0c655ecd0", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3529, "timestamp_epoch": "1580345765.019389000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-dba1bdabbadb3a10ba5afb2f", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3530, "timestamp_epoch": "1580345765.019616000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e41117b5ef1dba801e8db373", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3531, "timestamp_epoch": "1580345765.019830000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-bf535efc87b682992d63fee7", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3532, "timestamp_epoch": "1580345765.020175000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-136187e97222722c5b158f16", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3533, "timestamp_epoch": "1580345765.020424000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-6d18c08d24250e34ab12ae0d", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 3534, "timestamp_epoch": "1580345765.020602000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-65c8fc5c11394d3747873bae", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3539, "timestamp_epoch": "1580345765.023482000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-2eb1a78b797f7e7921903fcc", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3541, "timestamp_epoch": "1580345765.023938000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-0cc9019217ee1162ba4aa1d2", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3544, "timestamp_epoch": "1580345765.025808000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b248090e5be6028ab379c267", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3546, "timestamp_epoch": "1580345765.026707000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-6f62a272815da3e0306ff772", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3547, "timestamp_epoch": "1580345765.027538000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8d91bec00950a21007d98967", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3548, "timestamp_epoch": "1580345765.028061000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-9026fe57754466695e7b0255", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3549, "timestamp_epoch": "1580345765.028632000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-d6c01886b6a163fcf4592d58", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3550, "timestamp_epoch": "1580345765.029031000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-b432397e519799d93272287a", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3551, "timestamp_epoch": "1580345765.029378000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-b3652ff1a7e335d91cd26c53", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3552, "timestamp_epoch": "1580345765.029701000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f7606f809c926c915e2eba96", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3557, "timestamp_epoch": "1580345765.034925000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-e5a7ac7de82f6cf7f0a19033", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3559, "timestamp_epoch": "1580345765.035899000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-eb935a2c2ce9b9bd8cc6a2c4", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3560, "timestamp_epoch": "1580345765.036673000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-9dbc61769d504e7d8022e321", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3563, "timestamp_epoch": "1580345765.037101000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-577a96ed442778c35f3c9684", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3565, "timestamp_epoch": "1580345765.037980000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-8f3c3c3bcd5685fd42ec2cb5", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3566, "timestamp_epoch": "1580345765.038374000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-44fedb285f549e91b5aeca83", "src_port": null, "tcp_stream": 67, "udp_stream": null, "frame_number": 3567, "timestamp_epoch": "1580345765.038865000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-2e943ee330d4b4bfa106f367", "src_port": null, "tcp_stream": 66, "udp_stream": null, "frame_number": 3571, "timestamp_epoch": "1580345765.039513000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-4dabe103a12366f854795424", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7765, "timestamp_epoch": "1580345993.987371000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-73ccd4a8998df144cf80f1bc", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7766, "timestamp_epoch": "1580345993.987623000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-86fcd544f6517808b4a81c80", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7767, "timestamp_epoch": "1580345993.988095000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-0ea01fb9a7ec8f6325b11879", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7768, "timestamp_epoch": "1580345993.988432000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1071370f88b840876a995868", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7769, "timestamp_epoch": "1580345993.988675000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4530b68c5da29e21c1945748", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7770, "timestamp_epoch": "1580345993.988855000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a598d33d035c259e5fe7ef3c", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7773, "timestamp_epoch": "1580345993.990416000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "0" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-729f3d42b9fac6aafa5d28d8", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7774, "timestamp_epoch": "1580345993.990664000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-052d76c298ee5949200076aa", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7775, "timestamp_epoch": "1580345993.990937000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "12" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-162693eb1299b1f84757118f", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7776, "timestamp_epoch": "1580345993.991274000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-c18f09867b9fbd7ea64eba92", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7777, "timestamp_epoch": "1580345993.991518000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "drsuapi.opnum": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-324ad3534a746ac5f56af955", "src_port": null, "tcp_stream": 73, "udp_stream": null, "frame_number": 7778, "timestamp_epoch": "1580345993.991697000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-1f1c02a8ae777fc01b6cfc12", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7782, "timestamp_epoch": "1580345993.993975000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-fa003f3891b4ad675d624d10", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7784, "timestamp_epoch": "1580345993.994307000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-a8cf23a6460528d926979ec1", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7787, "timestamp_epoch": "1580345993.995346000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-526076149c84c52cf7ac8d4e", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7789, "timestamp_epoch": "1580345993.996111000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e1caeb50349b9c24b99db71a", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7790, "timestamp_epoch": "1580345993.996601000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-80cf14048fdfe938c65738c8", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7791, "timestamp_epoch": "1580345993.996900000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-10d6e7218f66b00f34f3d9f4", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7792, "timestamp_epoch": "1580345993.997177000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-4e9c77f16a71c917cc916883", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7793, "timestamp_epoch": "1580345993.997398000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-4C02EMG,CN=Computers,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-d71ec7fcb1ece1e613304448", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7794, "timestamp_epoch": "1580345993.997667000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-919425e6558fd4f495269067", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7795, "timestamp_epoch": "1580345993.997888000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "0" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-490f65d7695afdc6fd84a30f", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7800, "timestamp_epoch": "1580345994.001465000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "1" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-9d0c4cfee2fb2e4f7b526a0c", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7802, "timestamp_epoch": "1580345994.002282000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-23b68d74293022c725b33313", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7803, "timestamp_epoch": "1580345994.002726000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-501d02dd07594a24e92015ab", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7806, "timestamp_epoch": "1580345994.003022000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=sol-lightnet,DC=com", "ldap.protocolOp": "3" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-f37a05261a5cab15f7697a92", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7808, "timestamp_epoch": "1580345994.003455000" }, { "kind": "directory_service", "dst_ip": "10.20.30.227", "fields": { "ldap.protocolOp": "5" }, "src_ip": "10.20.30.2", "dst_port": null, "event_id": "evt-c9f8045506cf836817c886be", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7809, "timestamp_epoch": "1580345994.003714000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-e75d064800d4ac579389775b", "src_port": null, "tcp_stream": 75, "udp_stream": null, "frame_number": 7810, "timestamp_epoch": "1580345994.004022000" }, { "kind": "directory_service", "dst_ip": "10.20.30.2", "fields": { "ldap.protocolOp": "2" }, "src_ip": "10.20.30.227", "dst_port": null, "event_id": "evt-fb3f659b9c3013883926e706", "src_port": null, "tcp_stream": 74, "udp_stream": null, "frame_number": 7814, "timestamp_epoch": "1580345994.004640000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 13504, "interface_ids": [], "source_sha256": "51c84227023072a05ed3b4cae03662c7df80780551b6119c8af97301472642d4", "captured_bytes": 8393314, "protocol_counts": { "ip": 13504, "cms": 3, "dns": 166, "eth": 13504, "ntp": 2, "png": 9, "smb": 5, "tcp": 13188, "tls": 1714, "udp": 314, "xml": 6, "data": 61, "http": 138, "igmp": 4, "json": 7, "ldap": 158, "mdns": 18, "nbns": 66, "nbss": 223, "ocsp": 20, "smb2": 220, "ssdp": 16, "cldap": 28, "llmnr": 16, "media": 5, "nbdgm": 2, "dcerpc": 6294, "spnego": 80, "x509ce": 354, "browser": 2, "gss-api": 134, "ntlmssp": 5, "x509sat": 384, "kerberos": 44, "ethertype": 13504, "image-jfif": 6, "spnego-krb5": 332, "pkix1explicit": 40, "pkix1implicit": 40, "data-text-lines": 35, "urlencoded-form": 8 }, "duration_seconds": 569.849989, "last_packet_epoch": "1580346262.149261", "source_size_bytes": 8609402, "first_packet_epoch": "1580345692.299272", "encapsulation_types": [ 1 ] }, "summary": "Decoded 13504 packets across 45 IP endpoints and 261 transport flows. Observed 166 DNS events, 85 HTTP requests, 39 TLS ClientHello events, and 70 recovered file/message object(s). Deterministic rules produced 24 finding(s): 0 high, 18 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [ "Conflicting TCP overlap: fallback extraction rejected this direction" ], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 166, "truncated": false }, "dhcp": { "returned": 0, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 422, "truncated": false }, "http_request": { "returned": 85, "truncated": false }, "http_response": { "returned": 69, "truncated": false }, "tls_client_hello": { "returned": 39, "truncated": false }, "unclassified_tcp": { "returned": 52, "truncated": false }, "directory_service": { "returned": 256, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 4960097, "export_status": "completed", "unique_hashes": 70, "hashed_objects": 79, "compact_objects": 0, "detailed_objects": 70, "exported_objects": 79, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 70 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": false, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/sv.exe", "source": "49.51.133.162", "destination": "10.20.30.227", "content_type": "application/octet-stream", "response_count": 1, "declared_body_bytes": 81920 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" }, { "tcp_stream": 55, "frame_number": 1235, "display_filter": "frame.number == 1235", "timestamp_epoch": "1580345758.042190000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a2f92a8d5028870f86eb845a", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Repeated outbound HTTP POST activity", "status": "candidate", "metrics": { "uri": "/4/forum.php", "host": "twereptale.com", "port": 80, "source": "10.20.30.227", "destination": "81.177.6.156", "request_count": 5, "declared_body_bytes": 675 }, "rule_id": "repeated-http-posts", "evidence": [ { "tcp_stream": 57, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1580345758.838022000" }, { "tcp_stream": 70, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1580345885.104183000" }, { "tcp_stream": 76, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1580346005.497228000" }, { "tcp_stream": 80, "frame_number": 7916, "display_filter": "frame.number == 7916", "timestamp_epoch": "1580346125.870845000" }, { "tcp_stream": 127, "frame_number": 12855, "display_filter": "frame.number == 12855", "timestamp_epoch": "1580346246.270378000" } ], "severity": "medium", "confidence": 0.72, "finding_id": "finding-4374d41956c0deaa7b0a7227", "explanation": "The same endpoint pair and HTTP target produced repeated POST requests suitable for beaconing or data transfer review.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js", "source": "104.81.85.107", "destination": "10.20.30.227", "content_type": "text/javascript;charset=utf-8", "response_count": 1, "declared_body_bytes": 7489 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" }, { "tcp_stream": 108, "frame_number": 10081, "display_filter": "frame.number == 10081", "timestamp_epoch": "1580346176.032853000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-a37c3f190d19cebee4affcb6", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js", "source": "104.97.213.249", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 424648 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" }, { "tcp_stream": 109, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1580346176.105860000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-0d80335700324abd75053acd", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js", "source": "104.97.213.249", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 342081 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" }, { "tcp_stream": 112, "frame_number": 10645, "display_filter": "frame.number == 10645", "timestamp_epoch": "1580346176.084402000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-c4001dbe2ad3e10ae1bdc25d", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js", "source": "104.97.213.249", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 14928 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" }, { "tcp_stream": 110, "frame_number": 10068, "display_filter": "frame.number == 10068", "timestamp_epoch": "1580346176.028615000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-eb736237e3e0f5b1a36937ad", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Authentication-like token in cleartext HTTP URI", "status": "candidate", "metrics": { "host": "maps.googleapis.com", "path": "/maps/api/js", "source": "10.20.30.227", "destination": "172.217.9.170", "request_count": 1 }, "rule_id": "cleartext-tokenized-api", "evidence": [ { "tcp_stream": 134, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1580346261.207430000" } ], "severity": "medium", "confidence": 0.8, "finding_id": "finding-c3e36d091e5d2ec8be6957e1", "explanation": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/common.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 28564 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 134, "frame_number": 13042, "display_filter": "frame.number == 13042", "timestamp_epoch": "1580346261.292989000" }, { "tcp_stream": 134, "frame_number": 13084, "display_filter": "frame.number == 13084", "timestamp_epoch": "1580346261.358580000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-2de112f88dcf83156a81f951", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/util.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 53979 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 135, "frame_number": 13052, "display_filter": "frame.number == 13052", "timestamp_epoch": "1580346261.352193000" }, { "tcp_stream": 135, "frame_number": 13163, "display_filter": "frame.number == 13163", "timestamp_epoch": "1580346261.393381000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-7928e3b2b55de1c0acbe63aa", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/map.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 16283 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 137, "frame_number": 13054, "display_filter": "frame.number == 13054", "timestamp_epoch": "1580346261.352375000" }, { "tcp_stream": 137, "frame_number": 13121, "display_filter": "frame.number == 13121", "timestamp_epoch": "1580346261.378909000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-61f23c4390a76eb7d104922c", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/marker.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 11505 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 136, "frame_number": 13056, "display_filter": "frame.number == 13056", "timestamp_epoch": "1580346261.352557000" }, { "tcp_stream": 136, "frame_number": 13093, "display_filter": "frame.number == 13093", "timestamp_epoch": "1580346261.364830000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-00a3c361afe555454283e7e2", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/onion.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 9135 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 135, "frame_number": 13167, "display_filter": "frame.number == 13167", "timestamp_epoch": "1580346261.465995000" }, { "tcp_stream": 135, "frame_number": 13178, "display_filter": "frame.number == 13178", "timestamp_epoch": "1580346261.479483000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-63c5f8bba06307a1c7217aec", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/stats.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 1711 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 137, "frame_number": 13169, "display_filter": "frame.number == 13169", "timestamp_epoch": "1580346261.466132000" }, { "tcp_stream": 137, "frame_number": 13181, "display_filter": "frame.number == 13181", "timestamp_epoch": "1580346261.481061000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-811cd3e7daca098ea9c5f254", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Authentication-like token in cleartext HTTP URI", "status": "candidate", "metrics": { "host": "maps.googleapis.com", "path": "/maps/api/js/ViewportInfoService.GetViewportInfo", "source": "10.20.30.227", "destination": "172.217.9.170", "request_count": 1 }, "rule_id": "cleartext-tokenized-api", "evidence": [ { "tcp_stream": 135, "frame_number": 13187, "display_filter": "frame.number == 13187", "timestamp_epoch": "1580346261.491507000" } ], "severity": "medium", "confidence": 0.8, "finding_id": "finding-24258cf33df9c63f3da9f31c", "explanation": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.", "rule_version": "pcap-rules-v5" }, { "title": "Authentication-like token in cleartext HTTP URI", "status": "candidate", "metrics": { "host": "maps.googleapis.com", "path": "/maps/vt", "source": "10.20.30.227", "destination": "172.217.9.170", "request_count": 7 }, "rule_id": "cleartext-tokenized-api", "evidence": [ { "tcp_stream": 135, "frame_number": 13360, "display_filter": "frame.number == 13360", "timestamp_epoch": "1580346261.596304000" }, { "tcp_stream": 137, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1580346261.597334000" }, { "tcp_stream": 136, "frame_number": 13364, "display_filter": "frame.number == 13364", "timestamp_epoch": "1580346261.598688000" }, { "tcp_stream": 134, "frame_number": 13366, "display_filter": "frame.number == 13366", "timestamp_epoch": "1580346261.599495000" }, { "tcp_stream": 146, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1580346261.614212000" }, { "tcp_stream": 147, "frame_number": 13379, "display_filter": "frame.number == 13379", "timestamp_epoch": "1580346261.614438000" }, { "tcp_stream": 137, "frame_number": 13385, "display_filter": "frame.number == 13385", "timestamp_epoch": "1580346261.639565000" } ], "severity": "medium", "confidence": 0.8, "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "explanation": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.", "rule_version": "pcap-rules-v5" }, { "title": "Script, archive, or executable transfer candidate", "status": "candidate", "metrics": { "uri": "/maps-api-v3/api/js/38/11/controls.js", "source": "172.217.9.170", "destination": "10.20.30.227", "content_type": "text/javascript", "response_count": 1, "declared_body_bytes": 57507 }, "rule_id": "script-or-executable-transfer", "evidence": [ { "tcp_stream": 137, "frame_number": 13407, "display_filter": "frame.number == 13407", "timestamp_epoch": "1580346261.955338000" }, { "tcp_stream": 137, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1580346261.986607000" } ], "severity": "medium", "confidence": 0.86, "finding_id": "finding-8662d88305eabe87cdf18070", "explanation": "HTTP metadata names a script, archive, or executable. This is a transfer candidate, not proof of file type, execution, or malicious intent; legitimate updates use the same formats.", "rule_version": "pcap-rules-v5" }, { "title": "Authentication-like token in cleartext HTTP URI", "status": "candidate", "metrics": { "host": "maps.googleapis.com", "path": "/maps/api/js/AuthenticationService.Authenticate", "source": "10.20.30.227", "destination": "172.217.9.170", "request_count": 1 }, "rule_id": "cleartext-tokenized-api", "evidence": [ { "tcp_stream": 146, "frame_number": 13409, "display_filter": "frame.number == 13409", "timestamp_epoch": "1580346261.955975000" } ], "severity": "medium", "confidence": 0.8, "finding_id": "finding-4ccbf4ba009b4882e4c367c4", "explanation": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.", "rule_version": "pcap-rules-v5" }, { "title": "Authentication-like token in cleartext HTTP URI", "status": "candidate", "metrics": { "host": "maps.googleapis.com", "path": "/maps/api/js/QuotaService.RecordEvent", "source": "10.20.30.227", "destination": "172.217.9.170", "request_count": 1 }, "rule_id": "cleartext-tokenized-api", "evidence": [ { "tcp_stream": 146, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1580346262.073117000" } ], "severity": "medium", "confidence": 0.8, "finding_id": "finding-96ad3dbaa154e41ef3d6b17f", "explanation": "An HTTP request exposed a token-, key-, auth-, or session-like value in the URI. This is a review lead and a credential-exposure concern even when the application is legitimate.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.20.30.2", "protocol": "drsuapi", "destination": "10.20.30.227", "event_count": 38, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 9, "frame_number": 137, "display_filter": "frame.number == 137", "timestamp_epoch": "1580345692.856017000" }, { "tcp_stream": 9, "frame_number": 139, "display_filter": "frame.number == 139", "timestamp_epoch": "1580345692.857566000" }, { "tcp_stream": 9, "frame_number": 141, "display_filter": "frame.number == 141", "timestamp_epoch": "1580345692.858467000" }, { "tcp_stream": 9, "frame_number": 152, "display_filter": "frame.number == 152", "timestamp_epoch": "1580345692.866461000" }, { "tcp_stream": 9, "frame_number": 154, "display_filter": "frame.number == 154", "timestamp_epoch": "1580345692.869352000" }, { "tcp_stream": 9, "frame_number": 156, "display_filter": "frame.number == 156", "timestamp_epoch": "1580345692.871496000" }, { "tcp_stream": 9, "frame_number": 267, "display_filter": "frame.number == 267", "timestamp_epoch": "1580345693.509983000" }, { "tcp_stream": 9, "frame_number": 269, "display_filter": "frame.number == 269", "timestamp_epoch": "1580345693.510518000" }, { "tcp_stream": 9, "frame_number": 271, "display_filter": "frame.number == 271", "timestamp_epoch": "1580345693.510986000" }, { "tcp_stream": 9, "frame_number": 273, "display_filter": "frame.number == 273", "timestamp_epoch": "1580345693.511346000" }, { "tcp_stream": 27, "frame_number": 551, "display_filter": "frame.number == 551", "timestamp_epoch": "1580345695.929394000" }, { "tcp_stream": 27, "frame_number": 553, "display_filter": "frame.number == 553", "timestamp_epoch": "1580345695.930024000" }, { "tcp_stream": 27, "frame_number": 555, "display_filter": "frame.number == 555", "timestamp_epoch": "1580345695.930391000" }, { "tcp_stream": 27, "frame_number": 559, "display_filter": "frame.number == 559", "timestamp_epoch": "1580345695.931646000" }, { "tcp_stream": 27, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1580345695.932134000" }, { "tcp_stream": 27, "frame_number": 563, "display_filter": "frame.number == 563", "timestamp_epoch": "1580345695.932493000" }, { "tcp_stream": 9, "frame_number": 756, "display_filter": "frame.number == 756", "timestamp_epoch": "1580345703.964462000" }, { "tcp_stream": 9, "frame_number": 758, "display_filter": "frame.number == 758", "timestamp_epoch": "1580345703.965690000" }, { "tcp_stream": 9, "frame_number": 760, "display_filter": "frame.number == 760", "timestamp_epoch": "1580345703.966638000" }, { "tcp_stream": 9, "frame_number": 762, "display_filter": "frame.number == 762", "timestamp_epoch": "1580345703.967527000" }, { "tcp_stream": 50, "frame_number": 1068, "display_filter": "frame.number == 1068", "timestamp_epoch": "1580345751.401185000" }, { "tcp_stream": 50, "frame_number": 1070, "display_filter": "frame.number == 1070", "timestamp_epoch": "1580345751.402072000" }, { "tcp_stream": 50, "frame_number": 1072, "display_filter": "frame.number == 1072", "timestamp_epoch": "1580345751.402704000" }, { "tcp_stream": 50, "frame_number": 1076, "display_filter": "frame.number == 1076", "timestamp_epoch": "1580345751.405678000" }, { "tcp_stream": 50, "frame_number": 1078, "display_filter": "frame.number == 1078", "timestamp_epoch": "1580345751.406353000" }, { "tcp_stream": 50, "frame_number": 1080, "display_filter": "frame.number == 1080", "timestamp_epoch": "1580345751.406726000" }, { "tcp_stream": 65, "frame_number": 3522, "display_filter": "frame.number == 3522", "timestamp_epoch": "1580345765.016581000" }, { "tcp_stream": 65, "frame_number": 3524, "display_filter": "frame.number == 3524", "timestamp_epoch": "1580345765.017378000" }, { "tcp_stream": 65, "frame_number": 3526, "display_filter": "frame.number == 3526", "timestamp_epoch": "1580345765.017851000" }, { "tcp_stream": 65, "frame_number": 3530, "display_filter": "frame.number == 3530", "timestamp_epoch": "1580345765.019616000" }, { "tcp_stream": 65, "frame_number": 3532, "display_filter": "frame.number == 3532", "timestamp_epoch": "1580345765.020175000" }, { "tcp_stream": 65, "frame_number": 3534, "display_filter": "frame.number == 3534", "timestamp_epoch": "1580345765.020602000" }, { "tcp_stream": 73, "frame_number": 7766, "display_filter": "frame.number == 7766", "timestamp_epoch": "1580345993.987623000" }, { "tcp_stream": 73, "frame_number": 7768, "display_filter": "frame.number == 7768", "timestamp_epoch": "1580345993.988432000" }, { "tcp_stream": 73, "frame_number": 7770, "display_filter": "frame.number == 7770", "timestamp_epoch": "1580345993.988855000" }, { "tcp_stream": 73, "frame_number": 7774, "display_filter": "frame.number == 7774", "timestamp_epoch": "1580345993.990664000" }, { "tcp_stream": 73, "frame_number": 7776, "display_filter": "frame.number == 7776", "timestamp_epoch": "1580345993.991274000" }, { "tcp_stream": 73, "frame_number": 7778, "display_filter": "frame.number == 7778", "timestamp_epoch": "1580345993.991697000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-bf328193504a65e143b674cf", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.20.30.2", "protocol": "ldap", "destination": "10.20.30.227", "event_count": 67, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 4, "frame_number": 61, "display_filter": "frame.number == 61", "timestamp_epoch": "1580345692.820060000" }, { "tcp_stream": 4, "frame_number": 121, "display_filter": "frame.number == 121", "timestamp_epoch": "1580345692.850208000" }, { "tcp_stream": 4, "frame_number": 130, "display_filter": "frame.number == 130", "timestamp_epoch": "1580345692.852541000" }, { "tcp_stream": 4, "frame_number": 136, "display_filter": "frame.number == 136", "timestamp_epoch": "1580345692.855710000" }, { "tcp_stream": 4, "frame_number": 171, "display_filter": "frame.number == 171", "timestamp_epoch": "1580345693.005854000" }, { "tcp_stream": 4, "frame_number": 184, "display_filter": "frame.number == 184", "timestamp_epoch": "1580345693.208817000" }, { "tcp_stream": 4, "frame_number": 240, "display_filter": "frame.number == 240", "timestamp_epoch": "1580345693.318510000" }, { "tcp_stream": 4, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1580345693.320073000" }, { "tcp_stream": 4, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1580345693.321361000" }, { "tcp_stream": 18, "frame_number": 286, "display_filter": "frame.number == 286", "timestamp_epoch": "1580345694.044281000" }, { "tcp_stream": 18, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1580345694.046938000" }, { "tcp_stream": 18, "frame_number": 306, "display_filter": "frame.number == 306", "timestamp_epoch": "1580345694.087635000" }, { "tcp_stream": 20, "frame_number": 313, "display_filter": "frame.number == 313", "timestamp_epoch": "1580345694.104991000" }, { "tcp_stream": 20, "frame_number": 315, "display_filter": "frame.number == 315", "timestamp_epoch": "1580345694.105778000" }, { "tcp_stream": 20, "frame_number": 317, "display_filter": "frame.number == 317", "timestamp_epoch": "1580345694.106259000" }, { "tcp_stream": 18, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1580345694.107469000" }, { "tcp_stream": 28, "frame_number": 569, "display_filter": "frame.number == 569", "timestamp_epoch": "1580345695.935224000" }, { "tcp_stream": 28, "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1580345695.937699000" }, { "tcp_stream": 28, "frame_number": 576, "display_filter": "frame.number == 576", "timestamp_epoch": "1580345695.938900000" }, { "tcp_stream": 28, "frame_number": 578, "display_filter": "frame.number == 578", "timestamp_epoch": "1580345695.939415000" }, { "tcp_stream": 28, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1580345695.939839000" }, { "tcp_stream": 29, "frame_number": 587, "display_filter": "frame.number == 587", "timestamp_epoch": "1580345695.943044000" }, { "tcp_stream": 29, "frame_number": 591, "display_filter": "frame.number == 591", "timestamp_epoch": "1580345695.943655000" }, { "tcp_stream": 29, "frame_number": 594, "display_filter": "frame.number == 594", "timestamp_epoch": "1580345695.944348000" }, { "tcp_stream": 30, "frame_number": 628, "display_filter": "frame.number == 628", "timestamp_epoch": "1580345700.678066000" }, { "tcp_stream": 30, "frame_number": 633, "display_filter": "frame.number == 633", "timestamp_epoch": "1580345700.679712000" }, { "tcp_stream": 30, "frame_number": 635, "display_filter": "frame.number == 635", "timestamp_epoch": "1580345700.681840000" }, { "tcp_stream": 30, "frame_number": 637, "display_filter": "frame.number == 637", "timestamp_epoch": "1580345700.682289000" }, { "tcp_stream": 30, "frame_number": 639, "display_filter": "frame.number == 639", "timestamp_epoch": "1580345700.682757000" }, { "tcp_stream": 30, "frame_number": 641, "display_filter": "frame.number == 641", "timestamp_epoch": "1580345700.683209000" }, { "tcp_stream": 30, "frame_number": 643, "display_filter": "frame.number == 643", "timestamp_epoch": "1580345700.683710000" }, { "tcp_stream": 31, "frame_number": 653, "display_filter": "frame.number == 653", "timestamp_epoch": "1580345700.810342000" }, { "tcp_stream": 31, "frame_number": 655, "display_filter": "frame.number == 655", "timestamp_epoch": "1580345700.812276000" }, { "tcp_stream": 31, "frame_number": 687, "display_filter": "frame.number == 687", "timestamp_epoch": "1580345700.829357000" }, { "tcp_stream": 45, "frame_number": 896, "display_filter": "frame.number == 896", "timestamp_epoch": "1580345704.330187000" }, { "tcp_stream": 45, "frame_number": 898, "display_filter": "frame.number == 898", "timestamp_epoch": "1580345704.337118000" }, { "tcp_stream": 46, "frame_number": 905, "display_filter": "frame.number == 905", "timestamp_epoch": "1580345704.356166000" }, { "tcp_stream": 46, "frame_number": 907, "display_filter": "frame.number == 907", "timestamp_epoch": "1580345704.359341000" }, { "tcp_stream": 46, "frame_number": 909, "display_filter": "frame.number == 909", "timestamp_epoch": "1580345704.360141000" }, { "tcp_stream": 45, "frame_number": 911, "display_filter": "frame.number == 911", "timestamp_epoch": "1580345704.361024000" }, { "tcp_stream": 51, "frame_number": 1086, "display_filter": "frame.number == 1086", "timestamp_epoch": "1580345751.411190000" }, { "tcp_stream": 51, "frame_number": 1091, "display_filter": "frame.number == 1091", "timestamp_epoch": "1580345751.414003000" }, { "tcp_stream": 51, "frame_number": 1093, "display_filter": "frame.number == 1093", "timestamp_epoch": "1580345751.414743000" }, { "tcp_stream": 51, "frame_number": 1095, "display_filter": "frame.number == 1095", "timestamp_epoch": "1580345751.415415000" }, { "tcp_stream": 51, "frame_number": 1097, "display_filter": "frame.number == 1097", "timestamp_epoch": "1580345751.415917000" }, { "tcp_stream": 52, "frame_number": 1104, "display_filter": "frame.number == 1104", "timestamp_epoch": "1580345751.423365000" }, { "tcp_stream": 52, "frame_number": 1108, "display_filter": "frame.number == 1108", "timestamp_epoch": "1580345751.424193000" }, { "tcp_stream": 52, "frame_number": 1111, "display_filter": "frame.number == 1111", "timestamp_epoch": "1580345751.424803000" }, { "tcp_stream": 54, "frame_number": 1154, "display_filter": "frame.number == 1154", "timestamp_epoch": "1580345753.460189000" }, { "tcp_stream": 54, "frame_number": 1159, "display_filter": "frame.number == 1159", "timestamp_epoch": "1580345753.466606000" }, { "tcp_stream": 54, "frame_number": 1161, "display_filter": "frame.number == 1161", "timestamp_epoch": "1580345753.485586000" }, { "tcp_stream": 66, "frame_number": 3541, "display_filter": "frame.number == 3541", "timestamp_epoch": "1580345765.023938000" }, { "tcp_stream": 66, "frame_number": 3546, "display_filter": "frame.number == 3546", "timestamp_epoch": "1580345765.026707000" }, { "tcp_stream": 66, "frame_number": 3548, "display_filter": "frame.number == 3548", "timestamp_epoch": "1580345765.028061000" }, { "tcp_stream": 66, "frame_number": 3550, "display_filter": "frame.number == 3550", "timestamp_epoch": "1580345765.029031000" }, { "tcp_stream": 66, "frame_number": 3552, "display_filter": "frame.number == 3552", "timestamp_epoch": "1580345765.029701000" }, { "tcp_stream": 67, "frame_number": 3559, "display_filter": "frame.number == 3559", "timestamp_epoch": "1580345765.035899000" }, { "tcp_stream": 67, "frame_number": 3563, "display_filter": "frame.number == 3563", "timestamp_epoch": "1580345765.037101000" }, { "tcp_stream": 67, "frame_number": 3566, "display_filter": "frame.number == 3566", "timestamp_epoch": "1580345765.038374000" }, { "tcp_stream": 74, "frame_number": 7784, "display_filter": "frame.number == 7784", "timestamp_epoch": "1580345993.994307000" }, { "tcp_stream": 74, "frame_number": 7789, "display_filter": "frame.number == 7789", "timestamp_epoch": "1580345993.996111000" }, { "tcp_stream": 74, "frame_number": 7791, "display_filter": "frame.number == 7791", "timestamp_epoch": "1580345993.996900000" }, { "tcp_stream": 74, "frame_number": 7793, "display_filter": "frame.number == 7793", "timestamp_epoch": "1580345993.997398000" }, { "tcp_stream": 74, "frame_number": 7795, "display_filter": "frame.number == 7795", "timestamp_epoch": "1580345993.997888000" }, { "tcp_stream": 75, "frame_number": 7802, "display_filter": "frame.number == 7802", "timestamp_epoch": "1580345994.002282000" }, { "tcp_stream": 75, "frame_number": 7806, "display_filter": "frame.number == 7806", "timestamp_epoch": "1580345994.003022000" }, { "tcp_stream": 75, "frame_number": 7809, "display_filter": "frame.number == 7809", "timestamp_epoch": "1580345994.003714000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-5d5317bbda3807c7d40c1bd5", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.20.30.2", "protocol": "samr", "destination": "10.20.30.227", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 40, "frame_number": 807, "display_filter": "frame.number == 807", "timestamp_epoch": "1580345704.163467000" }, { "tcp_stream": 40, "frame_number": 809, "display_filter": "frame.number == 809", "timestamp_epoch": "1580345704.164464000" }, { "tcp_stream": 40, "frame_number": 811, "display_filter": "frame.number == 811", "timestamp_epoch": "1580345704.165107000" }, { "tcp_stream": 40, "frame_number": 813, "display_filter": "frame.number == 813", "timestamp_epoch": "1580345704.166052000" }, { "tcp_stream": 40, "frame_number": 815, "display_filter": "frame.number == 815", "timestamp_epoch": "1580345704.167925000" }, { "tcp_stream": 40, "frame_number": 817, "display_filter": "frame.number == 817", "timestamp_epoch": "1580345704.170054000" }, { "tcp_stream": 40, "frame_number": 819, "display_filter": "frame.number == 819", "timestamp_epoch": "1580345704.171079000" }, { "tcp_stream": 40, "frame_number": 821, "display_filter": "frame.number == 821", "timestamp_epoch": "1580345704.172301000" }, { "tcp_stream": 40, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1580345704.174805000" }, { "tcp_stream": 40, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1580345704.175617000" }, { "tcp_stream": 40, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1580345704.176484000" }, { "tcp_stream": 40, "frame_number": 829, "display_filter": "frame.number == 829", "timestamp_epoch": "1580345704.178491000" }, { "tcp_stream": 40, "frame_number": 831, "display_filter": "frame.number == 831", "timestamp_epoch": "1580345704.179228000" }, { "tcp_stream": 40, "frame_number": 833, "display_filter": "frame.number == 833", "timestamp_epoch": "1580345704.179939000" }, { "tcp_stream": 40, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1580345704.180505000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-223c152cffb22ceb2c24d58e", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.20.30.227", "protocol": "drsuapi", "destination": "10.20.30.2", "event_count": 38, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 9, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1580345692.855690000" }, { "tcp_stream": 9, "frame_number": 138, "display_filter": "frame.number == 138", "timestamp_epoch": "1580345692.856815000" }, { "tcp_stream": 9, "frame_number": 140, "display_filter": "frame.number == 140", "timestamp_epoch": "1580345692.857872000" }, { "tcp_stream": 9, "frame_number": 151, "display_filter": "frame.number == 151", "timestamp_epoch": "1580345692.865852000" }, { "tcp_stream": 9, "frame_number": 153, "display_filter": "frame.number == 153", "timestamp_epoch": "1580345692.868324000" }, { "tcp_stream": 9, "frame_number": 155, "display_filter": "frame.number == 155", "timestamp_epoch": "1580345692.871126000" }, { "tcp_stream": 9, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1580345693.509753000" }, { "tcp_stream": 9, "frame_number": 268, "display_filter": "frame.number == 268", "timestamp_epoch": "1580345693.510223000" }, { "tcp_stream": 9, "frame_number": 270, "display_filter": "frame.number == 270", "timestamp_epoch": "1580345693.510773000" }, { "tcp_stream": 9, "frame_number": 272, "display_filter": "frame.number == 272", "timestamp_epoch": "1580345693.511204000" }, { "tcp_stream": 27, "frame_number": 550, "display_filter": "frame.number == 550", "timestamp_epoch": "1580345695.929186000" }, { "tcp_stream": 27, "frame_number": 552, "display_filter": "frame.number == 552", "timestamp_epoch": "1580345695.929718000" }, { "tcp_stream": 27, "frame_number": 554, "display_filter": "frame.number == 554", "timestamp_epoch": "1580345695.930249000" }, { "tcp_stream": 27, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1580345695.931479000" }, { "tcp_stream": 27, "frame_number": 560, "display_filter": "frame.number == 560", "timestamp_epoch": "1580345695.931882000" }, { "tcp_stream": 27, "frame_number": 562, "display_filter": "frame.number == 562", "timestamp_epoch": "1580345695.932348000" }, { "tcp_stream": 9, "frame_number": 755, "display_filter": "frame.number == 755", "timestamp_epoch": "1580345703.964048000" }, { "tcp_stream": 9, "frame_number": 757, "display_filter": "frame.number == 757", "timestamp_epoch": "1580345703.964999000" }, { "tcp_stream": 9, "frame_number": 759, "display_filter": "frame.number == 759", "timestamp_epoch": "1580345703.966064000" }, { "tcp_stream": 9, "frame_number": 761, "display_filter": "frame.number == 761", "timestamp_epoch": "1580345703.967301000" }, { "tcp_stream": 50, "frame_number": 1067, "display_filter": "frame.number == 1067", "timestamp_epoch": "1580345751.400902000" }, { "tcp_stream": 50, "frame_number": 1069, "display_filter": "frame.number == 1069", "timestamp_epoch": "1580345751.401693000" }, { "tcp_stream": 50, "frame_number": 1071, "display_filter": "frame.number == 1071", "timestamp_epoch": "1580345751.402486000" }, { "tcp_stream": 50, "frame_number": 1075, "display_filter": "frame.number == 1075", "timestamp_epoch": "1580345751.405445000" }, { "tcp_stream": 50, "frame_number": 1077, "display_filter": "frame.number == 1077", "timestamp_epoch": "1580345751.405993000" }, { "tcp_stream": 50, "frame_number": 1079, "display_filter": "frame.number == 1079", "timestamp_epoch": "1580345751.406545000" }, { "tcp_stream": 65, "frame_number": 3521, "display_filter": "frame.number == 3521", "timestamp_epoch": "1580345765.016333000" }, { "tcp_stream": 65, "frame_number": 3523, "display_filter": "frame.number == 3523", "timestamp_epoch": "1580345765.017012000" }, { "tcp_stream": 65, "frame_number": 3525, "display_filter": "frame.number == 3525", "timestamp_epoch": "1580345765.017636000" }, { "tcp_stream": 65, "frame_number": 3529, "display_filter": "frame.number == 3529", "timestamp_epoch": "1580345765.019389000" }, { "tcp_stream": 65, "frame_number": 3531, "display_filter": "frame.number == 3531", "timestamp_epoch": "1580345765.019830000" }, { "tcp_stream": 65, "frame_number": 3533, "display_filter": "frame.number == 3533", "timestamp_epoch": "1580345765.020424000" }, { "tcp_stream": 73, "frame_number": 7765, "display_filter": "frame.number == 7765", "timestamp_epoch": "1580345993.987371000" }, { "tcp_stream": 73, "frame_number": 7767, "display_filter": "frame.number == 7767", "timestamp_epoch": "1580345993.988095000" }, { "tcp_stream": 73, "frame_number": 7769, "display_filter": "frame.number == 7769", "timestamp_epoch": "1580345993.988675000" }, { "tcp_stream": 73, "frame_number": 7773, "display_filter": "frame.number == 7773", "timestamp_epoch": "1580345993.990416000" }, { "tcp_stream": 73, "frame_number": 7775, "display_filter": "frame.number == 7775", "timestamp_epoch": "1580345993.990937000" }, { "tcp_stream": 73, "frame_number": 7777, "display_filter": "frame.number == 7777", "timestamp_epoch": "1580345993.991518000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-24e9540814d1e8ec9f064221", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.20.30.227", "protocol": "ldap", "destination": "10.20.30.2", "event_count": 83, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 4, "frame_number": 59, "display_filter": "frame.number == 59", "timestamp_epoch": "1580345692.819672000" }, { "tcp_stream": 4, "frame_number": 117, "display_filter": "frame.number == 117", "timestamp_epoch": "1580345692.848856000" }, { "tcp_stream": 4, "frame_number": 129, "display_filter": "frame.number == 129", "timestamp_epoch": "1580345692.852073000" }, { "tcp_stream": 4, "frame_number": 133, "display_filter": "frame.number == 133", "timestamp_epoch": "1580345692.855008000" }, { "tcp_stream": 4, "frame_number": 168, "display_filter": "frame.number == 168", "timestamp_epoch": "1580345693.005437000" }, { "tcp_stream": 4, "frame_number": 181, "display_filter": "frame.number == 181", "timestamp_epoch": "1580345693.208499000" }, { "tcp_stream": 4, "frame_number": 238, "display_filter": "frame.number == 238", "timestamp_epoch": "1580345693.318150000" }, { "tcp_stream": 4, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1580345693.319724000" }, { "tcp_stream": 4, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1580345693.321106000" }, { "tcp_stream": 4, "frame_number": 251, "display_filter": "frame.number == 251", "timestamp_epoch": "1580345693.321582000" }, { "tcp_stream": 18, "frame_number": 284, "display_filter": "frame.number == 284", "timestamp_epoch": "1580345694.043967000" }, { "tcp_stream": 18, "frame_number": 289, "display_filter": "frame.number == 289", "timestamp_epoch": "1580345694.046060000" }, { "tcp_stream": 18, "frame_number": 305, "display_filter": "frame.number == 305", "timestamp_epoch": "1580345694.087195000" }, { "tcp_stream": 20, "frame_number": 311, "display_filter": "frame.number == 311", "timestamp_epoch": "1580345694.104168000" }, { "tcp_stream": 20, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1580345694.105605000" }, { "tcp_stream": 20, "frame_number": 316, "display_filter": "frame.number == 316", "timestamp_epoch": "1580345694.106037000" }, { "tcp_stream": 18, "frame_number": 318, "display_filter": "frame.number == 318", "timestamp_epoch": "1580345694.107020000" }, { "tcp_stream": 20, "frame_number": 467, "display_filter": "frame.number == 467", "timestamp_epoch": "1580345694.349904000" }, { "tcp_stream": 18, "frame_number": 474, "display_filter": "frame.number == 474", "timestamp_epoch": "1580345694.421930000" }, { "tcp_stream": 28, "frame_number": 567, "display_filter": "frame.number == 567", "timestamp_epoch": "1580345695.934942000" }, { "tcp_stream": 28, "frame_number": 572, "display_filter": "frame.number == 572", "timestamp_epoch": "1580345695.937083000" }, { "tcp_stream": 28, "frame_number": 575, "display_filter": "frame.number == 575", "timestamp_epoch": "1580345695.938647000" }, { "tcp_stream": 28, "frame_number": 577, "display_filter": "frame.number == 577", "timestamp_epoch": "1580345695.939206000" }, { "tcp_stream": 28, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1580345695.939636000" }, { "tcp_stream": 29, "frame_number": 585, "display_filter": "frame.number == 585", "timestamp_epoch": "1580345695.942425000" }, { "tcp_stream": 29, "frame_number": 588, "display_filter": "frame.number == 588", "timestamp_epoch": "1580345695.943382000" }, { "tcp_stream": 29, "frame_number": 593, "display_filter": "frame.number == 593", "timestamp_epoch": "1580345695.944121000" }, { "tcp_stream": 29, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1580345695.944580000" }, { "tcp_stream": 28, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1580345695.944766000" }, { "tcp_stream": 30, "frame_number": 626, "display_filter": "frame.number == 626", "timestamp_epoch": "1580345700.677736000" }, { "tcp_stream": 30, "frame_number": 631, "display_filter": "frame.number == 631", "timestamp_epoch": "1580345700.679007000" }, { "tcp_stream": 30, "frame_number": 634, "display_filter": "frame.number == 634", "timestamp_epoch": "1580345700.681675000" }, { "tcp_stream": 30, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1580345700.682096000" }, { "tcp_stream": 30, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1580345700.682535000" }, { "tcp_stream": 30, "frame_number": 640, "display_filter": "frame.number == 640", "timestamp_epoch": "1580345700.683004000" }, { "tcp_stream": 30, "frame_number": 642, "display_filter": "frame.number == 642", "timestamp_epoch": "1580345700.683496000" }, { "tcp_stream": 31, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1580345700.809240000" }, { "tcp_stream": 31, "frame_number": 654, "display_filter": "frame.number == 654", "timestamp_epoch": "1580345700.811842000" }, { "tcp_stream": 31, "frame_number": 686, "display_filter": "frame.number == 686", "timestamp_epoch": "1580345700.828653000" }, { "tcp_stream": 31, "frame_number": 688, "display_filter": "frame.number == 688", "timestamp_epoch": "1580345700.831593000" }, { "tcp_stream": 30, "frame_number": 690, "display_filter": "frame.number == 690", "timestamp_epoch": "1580345700.837595000" }, { "tcp_stream": 45, "frame_number": 894, "display_filter": "frame.number == 894", "timestamp_epoch": "1580345704.329209000" }, { "tcp_stream": 45, "frame_number": 897, "display_filter": "frame.number == 897", "timestamp_epoch": "1580345704.336734000" }, { "tcp_stream": 46, "frame_number": 903, "display_filter": "frame.number == 903", "timestamp_epoch": "1580345704.355249000" }, { "tcp_stream": 46, "frame_number": 906, "display_filter": "frame.number == 906", "timestamp_epoch": "1580345704.359064000" }, { "tcp_stream": 46, "frame_number": 908, "display_filter": "frame.number == 908", "timestamp_epoch": "1580345704.359776000" }, { "tcp_stream": 45, "frame_number": 910, "display_filter": "frame.number == 910", "timestamp_epoch": "1580345704.360519000" }, { "tcp_stream": 46, "frame_number": 927, "display_filter": "frame.number == 927", "timestamp_epoch": "1580345704.689438000" }, { "tcp_stream": 45, "frame_number": 931, "display_filter": "frame.number == 931", "timestamp_epoch": "1580345704.694901000" }, { "tcp_stream": 51, "frame_number": 1084, "display_filter": "frame.number == 1084", "timestamp_epoch": "1580345751.410809000" }, { "tcp_stream": 51, "frame_number": 1089, "display_filter": "frame.number == 1089", "timestamp_epoch": "1580345751.413193000" }, { "tcp_stream": 51, "frame_number": 1092, "display_filter": "frame.number == 1092", "timestamp_epoch": "1580345751.414429000" }, { "tcp_stream": 51, "frame_number": 1094, "display_filter": "frame.number == 1094", "timestamp_epoch": "1580345751.415111000" }, { "tcp_stream": 51, "frame_number": 1096, "display_filter": "frame.number == 1096", "timestamp_epoch": "1580345751.415660000" }, { "tcp_stream": 52, "frame_number": 1102, "display_filter": "frame.number == 1102", "timestamp_epoch": "1580345751.422577000" }, { "tcp_stream": 52, "frame_number": 1105, "display_filter": "frame.number == 1105", "timestamp_epoch": "1580345751.423871000" }, { "tcp_stream": 52, "frame_number": 1110, "display_filter": "frame.number == 1110", "timestamp_epoch": "1580345751.424523000" }, { "tcp_stream": 52, "frame_number": 1112, "display_filter": "frame.number == 1112", "timestamp_epoch": "1580345751.424996000" }, { "tcp_stream": 51, "frame_number": 1115, "display_filter": "frame.number == 1115", "timestamp_epoch": "1580345751.425366000" }, { "tcp_stream": 54, "frame_number": 1152, "display_filter": "frame.number == 1152", "timestamp_epoch": "1580345753.459820000" }, { "tcp_stream": 54, "frame_number": 1157, "display_filter": "frame.number == 1157", "timestamp_epoch": "1580345753.465765000" }, { "tcp_stream": 54, "frame_number": 1160, "display_filter": "frame.number == 1160", "timestamp_epoch": "1580345753.484579000" }, { "tcp_stream": 54, "frame_number": 1162, "display_filter": "frame.number == 1162", "timestamp_epoch": "1580345753.494949000" }, { "tcp_stream": 66, "frame_number": 3539, "display_filter": "frame.number == 3539", "timestamp_epoch": "1580345765.023482000" }, { "tcp_stream": 66, "frame_number": 3544, "display_filter": "frame.number == 3544", "timestamp_epoch": "1580345765.025808000" }, { "tcp_stream": 66, "frame_number": 3547, "display_filter": "frame.number == 3547", "timestamp_epoch": "1580345765.027538000" }, { "tcp_stream": 66, "frame_number": 3549, "display_filter": "frame.number == 3549", "timestamp_epoch": "1580345765.028632000" }, { "tcp_stream": 66, "frame_number": 3551, "display_filter": "frame.number == 3551", "timestamp_epoch": "1580345765.029378000" }, { "tcp_stream": 67, "frame_number": 3557, "display_filter": "frame.number == 3557", "timestamp_epoch": "1580345765.034925000" }, { "tcp_stream": 67, "frame_number": 3560, "display_filter": "frame.number == 3560", "timestamp_epoch": "1580345765.036673000" }, { "tcp_stream": 67, "frame_number": 3565, "display_filter": "frame.number == 3565", "timestamp_epoch": "1580345765.037980000" }, { "tcp_stream": 67, "frame_number": 3567, "display_filter": "frame.number == 3567", "timestamp_epoch": "1580345765.038865000" }, { "tcp_stream": 66, "frame_number": 3571, "display_filter": "frame.number == 3571", "timestamp_epoch": "1580345765.039513000" }, { "tcp_stream": 74, "frame_number": 7782, "display_filter": "frame.number == 7782", "timestamp_epoch": "1580345993.993975000" }, { "tcp_stream": 74, "frame_number": 7787, "display_filter": "frame.number == 7787", "timestamp_epoch": "1580345993.995346000" }, { "tcp_stream": 74, "frame_number": 7790, "display_filter": "frame.number == 7790", "timestamp_epoch": "1580345993.996601000" }, { "tcp_stream": 74, "frame_number": 7792, "display_filter": "frame.number == 7792", "timestamp_epoch": "1580345993.997177000" }, { "tcp_stream": 74, "frame_number": 7794, "display_filter": "frame.number == 7794", "timestamp_epoch": "1580345993.997667000" }, { "tcp_stream": 75, "frame_number": 7800, "display_filter": "frame.number == 7800", "timestamp_epoch": "1580345994.001465000" }, { "tcp_stream": 75, "frame_number": 7803, "display_filter": "frame.number == 7803", "timestamp_epoch": "1580345994.002726000" }, { "tcp_stream": 75, "frame_number": 7808, "display_filter": "frame.number == 7808", "timestamp_epoch": "1580345994.003455000" }, { "tcp_stream": 75, "frame_number": 7810, "display_filter": "frame.number == 7810", "timestamp_epoch": "1580345994.004022000" }, { "tcp_stream": 74, "frame_number": 7814, "display_filter": "frame.number == 7814", "timestamp_epoch": "1580345994.004640000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-c90d55eb837fc61d7841d019", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "10.20.30.227", "protocol": "samr", "destination": "10.20.30.2", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 40, "frame_number": 806, "display_filter": "frame.number == 806", "timestamp_epoch": "1580345704.162960000" }, { "tcp_stream": 40, "frame_number": 808, "display_filter": "frame.number == 808", "timestamp_epoch": "1580345704.164228000" }, { "tcp_stream": 40, "frame_number": 810, "display_filter": "frame.number == 810", "timestamp_epoch": "1580345704.164864000" }, { "tcp_stream": 40, "frame_number": 812, "display_filter": "frame.number == 812", "timestamp_epoch": "1580345704.165665000" }, { "tcp_stream": 40, "frame_number": 814, "display_filter": "frame.number == 814", "timestamp_epoch": "1580345704.167573000" }, { "tcp_stream": 40, "frame_number": 816, "display_filter": "frame.number == 816", "timestamp_epoch": "1580345704.169477000" }, { "tcp_stream": 40, "frame_number": 818, "display_filter": "frame.number == 818", "timestamp_epoch": "1580345704.170618000" }, { "tcp_stream": 40, "frame_number": 820, "display_filter": "frame.number == 820", "timestamp_epoch": "1580345704.171814000" }, { "tcp_stream": 40, "frame_number": 822, "display_filter": "frame.number == 822", "timestamp_epoch": "1580345704.172479000" }, { "tcp_stream": 40, "frame_number": 824, "display_filter": "frame.number == 824", "timestamp_epoch": "1580345704.175103000" }, { "tcp_stream": 40, "frame_number": 826, "display_filter": "frame.number == 826", "timestamp_epoch": "1580345704.175953000" }, { "tcp_stream": 40, "frame_number": 828, "display_filter": "frame.number == 828", "timestamp_epoch": "1580345704.178212000" }, { "tcp_stream": 40, "frame_number": 830, "display_filter": "frame.number == 830", "timestamp_epoch": "1580345704.178948000" }, { "tcp_stream": 40, "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1580345704.179566000" }, { "tcp_stream": 40, "frame_number": 834, "display_filter": "frame.number == 834", "timestamp_epoch": "1580345704.180212000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-2707b31a97d360201fa8e057", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "117a5b52b949a037f43aed09cd46eeba", "sha1": "be17db26807bce486710733931ff6cf5bebde8eb", "type": "http-exported-object", "sha256": "2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b", "evidence": [ { "tcp_stream": 109, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1580346176.105860000" } ], "filename": "common-be17db26807bce4867107-min.en-US.js", "filenames": [ "common-be17db26807bce4867107-min.en-US.js" ], "transfers": [ { "url": "http://assets.squarespace.com/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js", "client_ip": "10.20.30.227", "server_ip": "104.97.213.249", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9991, "response_frame": 10744 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 1659717, "artifact_id": "artifact-23209c8ecd7d63bc758bc3e6", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 43302, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "fdefb508fc621937753e1c2dc8f4b495", "sha1": "41df59c1cae8ead1cbbbb3cef1af783136b69108", "type": "http-exported-object", "sha256": "f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12", "evidence": [ { "tcp_stream": 135, "frame_number": 13163, "display_filter": "frame.number == 13163", "timestamp_epoch": "1580346261.393381000" } ], "filename": "util.js", "filenames": [ "util.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/util.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13052, "response_frame": 13163 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 146174, "artifact_id": "artifact-28cb163c4b3c69c4c3bd7709", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 146174, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [ { "offset": 33879, "excerpt": "eval(", "feature": "dynamic-evaluation" } ], "content_kind": "script-like-text", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 146174, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "e409d5c467ca3ff5c7b4e4963629ee18", "sha1": "8ffdeebf7b41fe65b2d92eed18ddd6c39eeea2d8", "type": "http-exported-object", "sha256": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda", "evidence": [ { "tcp_stream": 55, "frame_number": 1235, "display_filter": "frame.number == 1235", "timestamp_epoch": "1580345758.042190000" } ], "filename": "sv.exe", "filenames": [ "sv.exe" ], "transfers": [ { "url": "http://gengrasjeepram.com/sv.exe", "client_ip": "10.20.30.227", "server_ip": "49.51.133.162", "tcp_stream": 55, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1169, "response_frame": 1235 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 81920, "artifact_id": "artifact-514d7133a43d58c3e612646a", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 81920, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 81920, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8ac56ebfedaa877fcc4518e68956d345", "sha1": "181ca5d368ee93562112cc1e15ee09e46bc3e428", "type": "http-exported-object", "sha256": "ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db", "evidence": [ { "tcp_stream": 112, "frame_number": 10645, "display_filter": "frame.number == 10645", "timestamp_epoch": "1580346176.084402000" } ], "filename": "commerce-181ca5d368ee93562112c-min.en-US.js", "filenames": [ "commerce-181ca5d368ee93562112c-min.en-US.js" ], "transfers": [ { "url": "http://assets.squarespace.com/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js", "client_ip": "10.20.30.227", "server_ip": "104.97.213.249", "tcp_stream": 112, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9993, "response_frame": 10645 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 1459260, "artifact_id": "artifact-a256c05fa1f2f6cf37519bfa", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5c9c0b0be25a2dfeac4417883d82bb98", "sha1": "98b83102f9d62e74324701711b204f1439052548", "type": "http-exported-object", "sha256": "6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f", "evidence": [ { "tcp_stream": 114, "frame_number": 10246, "display_filter": "frame.number == 10246", "timestamp_epoch": "1580346176.053445000" } ], "filename": "site.css%3f&filterFeatures=false", "filenames": [ "site.css%3f&filterFeatures=false" ], "transfers": [ { "url": "http://static1.squarespace.com/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false", "client_ip": "10.20.30.227", "server_ip": "151.101.0.238", "tcp_stream": 114, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 10010, "response_frame": 10246 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 542610, "artifact_id": "artifact-ca460e5265aaf97549a4eebb", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "141ad3be0dc23c12a76a821d919dabe8", "sha1": "58e86782a06760d0e7e9c427ddedd7600ef285ca", "type": "http-exported-object", "sha256": "29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d", "evidence": [ { "tcp_stream": 137, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1580346261.986607000" } ], "filename": "controls.js", "filenames": [ "controls.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/controls.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 137, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13407, "response_frame": 13467 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 213467, "artifact_id": "artifact-34529be275bd09ac94da931a", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 213467, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 213467, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "07d9cd2bbe3111a49f2e07ba65bcf92d", "sha1": "5dfa727104dfa02d8d3a339bc7e2ad4421a20939", "type": "http-exported-object", "sha256": "4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b", "evidence": [ { "tcp_stream": 134, "frame_number": 13035, "display_filter": "frame.number == 13035", "timestamp_epoch": "1580346261.237901000" } ], "filename": "js%3fv=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US", "filenames": [ "js%3fv=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 134, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12989, "response_frame": 13035 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 117672, "artifact_id": "artifact-6a5084652e320a72ef939e7d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 117672, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 117672, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2f34f6f334c8277edfe3361843c9cb7e", "sha1": "8f4088ba251a07c1d4eec4974e37baaa8ddd925f", "type": "http-exported-object", "sha256": "3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50", "evidence": [ { "tcp_stream": 134, "frame_number": 13084, "display_filter": "frame.number == 13084", "timestamp_epoch": "1580346261.358580000" } ], "filename": "common.js", "filenames": [ "common.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/common.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 134, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13042, "response_frame": 13084 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 77975, "artifact_id": "artifact-539d255275c8e25b4ca7eb8f", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 77975, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 77975, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d6f26f9077ec101b427f26337f155203", "sha1": "990a4fcc4489b69349e7f1115b546d8134ff92f9", "type": "http-exported-object", "sha256": "79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94", "evidence": [ { "tcp_stream": 106, "frame_number": 9963, "display_filter": "frame.number == 9963", "timestamp_epoch": "1580346175.975417000" } ], "filename": "%2f(3)", "filenames": [ "%2f(3)" ], "transfers": [ { "url": "http://www.tippingpointhampstead.com/", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9949, "response_frame": 9963 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 54163, "artifact_id": "artifact-edf8df482936adf4d0f6ebe5", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 54163, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 54163, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "26096cbfb43f2f1c1ceb1726b2168f54", "sha1": "ab9fd524dd81b9f35b6817f2c019c128fa85170b", "type": "http-exported-object", "sha256": "999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed", "evidence": [ { "tcp_stream": 58, "frame_number": 3487, "display_filter": "frame.number == 3487", "timestamp_epoch": "1580345764.898561000" } ], "filename": "2", "filenames": [ "2" ], "transfers": [ { "url": "http://xolightfinance.com/bhola/images/2", "client_ip": "10.20.30.227", "server_ip": "148.66.137.40", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 3430, "response_frame": 3487 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 47394, "artifact_id": "artifact-9abe53d7f59f56efac6b44f0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 47394, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 47394, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c0469c4b0aecb6a9bf9eceadbe6a3635", "sha1": "6c529d24ffaa4730ab163e2daa8b41406f29a124", "type": "http-exported-object", "sha256": "55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9", "evidence": [ { "tcp_stream": 110, "frame_number": 10068, "display_filter": "frame.number == 10068", "timestamp_epoch": "1580346176.028615000" } ], "filename": "performance-6c529d24ffaa4730ab163-min.en-US.js", "filenames": [ "performance-6c529d24ffaa4730ab163-min.en-US.js" ], "transfers": [ { "url": "http://assets.squarespace.com/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js", "client_ip": "10.20.30.227", "server_ip": "104.97.213.249", "tcp_stream": 110, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9995, "response_frame": 10068 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 47293, "artifact_id": "artifact-64d37cb5ffeab4223bf20cfa", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 47293, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 47293, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "673a98c749e09db2d4ee708b854a2ea5", "sha1": "776d1ccbe6c0dcd95155f6899e59270fdb5feec4", "type": "http-exported-object", "sha256": "f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627", "evidence": [ { "tcp_stream": 58, "frame_number": 1306, "display_filter": "frame.number == 1306", "timestamp_epoch": "1580345760.194399000" } ], "filename": "1", "filenames": [ "1" ], "transfers": [ { "url": "http://xolightfinance.com/bhola/images/1", "client_ip": "10.20.30.227", "server_ip": "148.66.137.40", "tcp_stream": 58, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1260, "response_frame": 1306 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 46334, "artifact_id": "artifact-01c85bc52f5521ee5d200db0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 46334, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 46334, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2c680fad043ffb2f48f8597985f9d6af", "sha1": "f62af1356d353430628c52b1a8ca163ef44da592", "type": "http-exported-object", "sha256": "ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf", "evidence": [ { "tcp_stream": 137, "frame_number": 13121, "display_filter": "frame.number == 13121", "timestamp_epoch": "1580346261.378909000" } ], "filename": "map.js", "filenames": [ "map.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/map.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 137, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13054, "response_frame": 13121 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 42435, "artifact_id": "artifact-84b4cadf4a680bacabab4747", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 42435, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 42435, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "497b73229d5a8cc623535edd5b0c254e", "sha1": "94144ff748aebbc0ef9b910f71f3802a38096231", "type": "http-exported-object", "sha256": "5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3", "evidence": [ { "tcp_stream": 128, "frame_number": 12942, "display_filter": "frame.number == 12942", "timestamp_epoch": "1580346260.359766000" } ], "filename": "contact", "filenames": [ "contact" ], "transfers": [ { "url": "http://www.tippingpointhampstead.com/contact", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 128, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12904, "response_frame": 12942 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 41620, "artifact_id": "artifact-334f1c413d17901b9d83fd73", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 41620, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 41620, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "236382984a4a7d627213318e6203c85e", "sha1": "41c7276656cfc056a746621a59f808e882bdcc78", "type": "http-exported-object", "sha256": "c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd", "evidence": [ { "tcp_stream": 136, "frame_number": 13093, "display_filter": "frame.number == 13093", "timestamp_epoch": "1580346261.364830000" } ], "filename": "marker.js", "filenames": [ "marker.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/marker.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 136, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13056, "response_frame": 13093 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 31427, "artifact_id": "artifact-ac7ad345e6712536dbb33a7d", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 31427, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 31427, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b2c902627861d4dcd785c764fd067f4e", "sha1": "9efe291c8232dabeb7a02262fb4e9af53a6a5857", "type": "http-exported-object", "sha256": "0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828", "evidence": [ { "tcp_stream": 135, "frame_number": 13228, "display_filter": "frame.number == 13228", "timestamp_epoch": "1580346261.538532000" } ], "filename": "ViewportInfoService.GetViewportInfo%3f1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]", "filenames": [ "ViewportInfoService.GetViewportInfo%3f1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13187, "response_frame": 13228 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 27756, "artifact_id": "artifact-db5e5b166047ae4cc2b24c6e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 27756, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 27756, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7c0dd8dc02254ee3692d825ae0a214b6", "sha1": "822dceb4ff5087c25933af3c9e2f6892468fb20d", "type": "http-exported-object", "sha256": "c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1", "evidence": [ { "tcp_stream": 135, "frame_number": 13178, "display_filter": "frame.number == 13178", "timestamp_epoch": "1580346261.479483000" } ], "filename": "onion.js", "filenames": [ "onion.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/onion.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13167, "response_frame": 13178 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 24657, "artifact_id": "artifact-5f90a183f33eb72ae98a4662", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 24657, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 24657, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a8b469f5e1cdb418c8acdfa0f434eb6a", "sha1": "03f6b850aeebdb00634ba58adcebb9b987d40a5e", "type": "http-exported-object", "sha256": "5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619", "evidence": [ { "tcp_stream": 142, "frame_number": 13336, "display_filter": "frame.number == 13336", "timestamp_epoch": "1580346261.562188000" } ], "filename": "kh%3fv=863&hl=en&x=2133&y=3317&z=13", "filenames": [ "kh%3fv=863&hl=en&x=2133&y=3317&z=13" ], "transfers": [ { "url": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3317&z=13", "client_ip": "10.20.30.227", "server_ip": "172.217.12.46", "tcp_stream": 142, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13219, "response_frame": 13336 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 23566, "artifact_id": "artifact-f6dc38e274d2705fb6869940", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23566, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23566, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b4d2c4c39853ee244272c04999b230ba", "sha1": "c82e22dde9716c40ba20e6c7ed03a1b66556de15", "type": "http-exported-object", "sha256": "c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1", "evidence": [ { "tcp_stream": 117, "frame_number": 11148, "display_filter": "frame.number == 11148", "timestamp_epoch": "1580346176.943197000" } ], "filename": "S6uyw4BMUTPHjx4wXg.woff2", "filenames": [ "S6uyw4BMUTPHjx4wXg.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2", "client_ip": "10.20.30.227", "server_ip": "172.217.14.163", "tcp_stream": 117, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 11080, "response_frame": 11148 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 23484, "artifact_id": "artifact-b6be09e147911930a901a3fd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 23484, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 23484, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1efbd38aa76ddae2580fedf378276333", "sha1": "8a49976f2470ba2a1db6144245355d3b889312e4", "type": "http-exported-object", "sha256": "8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20", "evidence": [ { "tcp_stream": 120, "frame_number": 11212, "display_filter": "frame.number == 11212", "timestamp_epoch": "1580346176.959437000" } ], "filename": "S6u9w4BMUTPHh6UVSwiPGQ.woff2", "filenames": [ "S6u9w4BMUTPHh6UVSwiPGQ.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2", "client_ip": "10.20.30.227", "server_ip": "172.217.14.163", "tcp_stream": 120, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 11111, "response_frame": 11212 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 22992, "artifact_id": "artifact-347fc787b0df9618aabe9245", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22992, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 22992, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9f7b7c03dea7ed515990f4db044f3353", "sha1": "9a21943e4c01265613f36b620fd92ad5eeeaf2ba", "type": "http-exported-object", "sha256": "07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1", "evidence": [ { "tcp_stream": 143, "frame_number": 13328, "display_filter": "frame.number == 13328", "timestamp_epoch": "1580346261.561226000" } ], "filename": "kh%3fv=863&hl=en&x=2135&y=3317&z=13", "filenames": [ "kh%3fv=863&hl=en&x=2135&y=3317&z=13" ], "transfers": [ { "url": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3317&z=13", "client_ip": "10.20.30.227", "server_ip": "172.217.12.46", "tcp_stream": 143, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13221, "response_frame": 13328 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 22721, "artifact_id": "artifact-b11a209a2b07106dde2f2adc", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22721, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 22721, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "73ee5c0dcf5f05ffb4756b17dc00f90d", "sha1": "5092d659fdad8c18acc93d9a782d138ffb3f3a1c", "type": "http-exported-object", "sha256": "97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6", "evidence": [ { "tcp_stream": 140, "frame_number": 13335, "display_filter": "frame.number == 13335", "timestamp_epoch": "1580346261.562179000" } ], "filename": "kh%3fv=863&hl=en&x=2134&y=3317&z=13", "filenames": [ "kh%3fv=863&hl=en&x=2134&y=3317&z=13" ], "transfers": [ { "url": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3317&z=13", "client_ip": "10.20.30.227", "server_ip": "172.217.2.238", "tcp_stream": 140, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13217, "response_frame": 13335 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 22229, "artifact_id": "artifact-266bf28fd64759db7741de10", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 22229, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 22229, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "9ca14b8703044ec44627982d6d0e1e44", "sha1": "e3e2ec190dfb76e15fbe4d3ca07da6af0679a589", "type": "http-exported-object", "sha256": "6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398", "evidence": [ { "tcp_stream": 121, "frame_number": 11220, "display_filter": "frame.number == 11220", "timestamp_epoch": "1580346176.960817000" } ], "filename": "S6u8w4BMUTPHh30AXC-q.woff2", "filenames": [ "S6u8w4BMUTPHh30AXC-q.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2", "client_ip": "10.20.30.227", "server_ip": "172.217.14.163", "tcp_stream": 121, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 11122, "response_frame": 11220 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 21580, "artifact_id": "artifact-dbbb7ad3279296a3b63a18d0", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21580, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 21580, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "48a90870ec9f6ac2f9d8825b370d6732", "sha1": "538f1f2335006e1fb8711a01b5c11e504741f026", "type": "http-exported-object", "sha256": "3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795", "evidence": [ { "tcp_stream": 141, "frame_number": 13334, "display_filter": "frame.number == 13334", "timestamp_epoch": "1580346261.562127000" } ], "filename": "kh%3fv=863&hl=en&x=2133&y=3318&z=13", "filenames": [ "kh%3fv=863&hl=en&x=2133&y=3318&z=13" ], "transfers": [ { "url": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3318&z=13", "client_ip": "10.20.30.227", "server_ip": "172.217.12.46", "tcp_stream": 141, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13215, "response_frame": 13334 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 21039, "artifact_id": "artifact-dc3e4a797c8f34eb2fc10042", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 21039, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 21039, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "56c11c00f539303f60e0a6ce3f606ec8", "sha1": "c810442ae1abaea97bebcd4fd6a8569db2954896", "type": "http-exported-object", "sha256": "126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e", "evidence": [ { "tcp_stream": 108, "frame_number": 10081, "display_filter": "frame.number == 10081", "timestamp_epoch": "1580346176.032853000" } ], "filename": "_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNl.js", "filenames": [ "_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNl.js" ], "transfers": [ { "url": "http://use.typekit.net/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js", "client_ip": "10.20.30.227", "server_ip": "104.81.85.107", "tcp_stream": 108, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9976, "response_frame": 10081 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 19548, "artifact_id": "artifact-ebd1287c000e2504fa3a9980", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19548, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19548, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a428ec6bb139448787bc2c86c4b5b8a8", "sha1": "41a263b22a5bbf0d2037472941e655ba72491f04", "type": "http-exported-object", "sha256": "10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b", "evidence": [ { "tcp_stream": 139, "frame_number": 13299, "display_filter": "frame.number == 13299", "timestamp_epoch": "1580346261.553068000" } ], "filename": "kh%3fv=863&hl=en&x=2134&y=3318&z=13", "filenames": [ "kh%3fv=863&hl=en&x=2134&y=3318&z=13" ], "transfers": [ { "url": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3318&z=13", "client_ip": "10.20.30.227", "server_ip": "172.217.2.238", "tcp_stream": 139, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13203, "response_frame": 13299 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 19250, "artifact_id": "artifact-00716e0476d5c4092c3e5c1c", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 19250, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 19250, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "40b2fd83c8feea5d2b5bdd8073124db3", "sha1": "c102f804b08dc80a68fcd701de20583ca4e550ea", "type": "http-exported-object", "sha256": "02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77", "evidence": [ { "tcp_stream": 144, "frame_number": 13357, "display_filter": "frame.number == 13357", "timestamp_epoch": "1580346261.579411000" } ], "filename": "kh%3fv=863&hl=en&x=2135&y=3318&z=13", "filenames": [ "kh%3fv=863&hl=en&x=2135&y=3318&z=13" ], "transfers": [ { "url": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3318&z=13", "client_ip": "10.20.30.227", "server_ip": "172.217.12.46", "tcp_stream": 144, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13223, "response_frame": 13357 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 16902, "artifact_id": "artifact-cfbf0f32136351fdca08784e", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 16902, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 16902, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "479970ffb74f2117317f9d24d9e317fe", "sha1": "81c796737cbe44d4a719777f0aff14b73a3efb1e", "type": "http-exported-object", "sha256": "48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3", "evidence": [ { "tcp_stream": 121, "frame_number": 13501, "display_filter": "frame.number == 13501", "timestamp_epoch": "1580346262.105312000" } ], "filename": "KFOmCnqEu92Fr1Mu4mxK.woff2", "filenames": [ "KFOmCnqEu92Fr1Mu4mxK.woff2" ], "transfers": [ { "url": "http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2", "client_ip": "10.20.30.227", "server_ip": "172.217.14.163", "tcp_stream": 121, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13483, "response_frame": 13501 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 15736, "artifact_id": "artifact-6f9782cfbc4a12ab7273d53d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15736, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 15736, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "46aeae7ba2e0a5a878ac0f9cd6f78686", "sha1": "c7705370535c687ba371a0c2c260cdfff6622f7d", "type": "http-exported-object", "sha256": "277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149", "evidence": [ { "tcp_stream": 113, "frame_number": 13476, "display_filter": "frame.number == 13476", "timestamp_epoch": "1580346262.062551000" } ], "filename": "css%3ffamily=Roboto%3a300,400,500,700%7cGoogle+Sans", "filenames": [ "css%3ffamily=Roboto%3a300,400,500,700%7cGoogle+Sans" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Google+Sans", "client_ip": "10.20.30.227", "server_ip": "172.217.14.170", "tcp_stream": 113, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13471, "response_frame": 13476 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 11036, "artifact_id": "artifact-cbf3467bf7f4c3d291e10505", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 11036, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 11036, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d5d1d165eb43a2fed99901e0e7b185a3", "sha1": "8b9f9d9e560afa50db555b4258a846aa7245d5c4", "type": "http-exported-object", "sha256": "74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16", "evidence": [ { "tcp_stream": 111, "frame_number": 10037, "display_filter": "frame.number == 10037", "timestamp_epoch": "1580346176.026280000" } ], "filename": "commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css", "filenames": [ "commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css" ], "transfers": [ { "url": "http://assets.squarespace.com/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css", "client_ip": "10.20.30.227", "server_ip": "104.97.213.249", "tcp_stream": 111, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9999, "response_frame": 10037 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/css", "size_bytes": 9882, "artifact_id": "artifact-19ce5e6533fa073ec5ed4cfd", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 9882, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 9882, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "94dff1faba9bea2f4d924a50b62edacc", "sha1": "ebaf55d1deff3b09306caa82a883758bf4e40ea7", "type": "http-exported-object", "sha256": "58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e", "evidence": [ { "tcp_stream": 137, "frame_number": 13181, "display_filter": "frame.number == 13181", "timestamp_epoch": "1580346261.481061000" } ], "filename": "stats.js", "filenames": [ "stats.js" ], "transfers": [ { "url": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/stats.js", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 137, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13169, "response_frame": 13181 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "text/javascript", "size_bytes": 3862, "artifact_id": "artifact-d8d51621def27c4bde6321f9", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3862, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3862, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3ca236f3899f59e6e007648fea9948fd", "sha1": "9734883c8cf2459068a410df38a32d64824c5902", "type": "http-exported-object", "sha256": "05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3", "evidence": [ { "tcp_stream": 113, "frame_number": 10196, "display_filter": "frame.number == 10196", "timestamp_epoch": "1580346176.045395000" } ], "filename": "css%3ffamily=Lato%3a100,400,700i,700,400i", "filenames": [ "css%3ffamily=Lato%3a100,400,700i,700,400i" ], "transfers": [ { "url": "http://fonts.googleapis.com/css?family=Lato:100,400,700i,700,400i", "client_ip": "10.20.30.227", "server_ip": "172.217.14.170", "tcp_stream": 113, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 10016, "response_frame": 10196 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3803, "artifact_id": "artifact-2d4068d12696e593de875f24", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3803, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3803, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "faeda88ecb285d867d6457c3778cad47", "sha1": "f3ba3584c4e013b3542ec75276300db78bc20f23", "type": "http-exported-object", "sha256": "3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75", "evidence": [ { "tcp_stream": 136, "frame_number": 13390, "display_filter": "frame.number == 13390", "timestamp_epoch": "1580346261.647062000" } ], "filename": "vt%3fpb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&", "filenames": [ "vt%3fpb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 136, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13364, "response_frame": 13390 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 3227, "artifact_id": "artifact-1802f804dabb92bcdc549909", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 3227, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 3227, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "92ac58616a5c101bc36f14b2fa5ade8c", "sha1": "9dbcc12141ebdf098a30df39bc7cfafbe5be018c", "type": "http-exported-object", "sha256": "c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443", "evidence": [ { "tcp_stream": 107, "frame_number": 11147, "display_filter": "frame.number == 11147", "timestamp_epoch": "1580346176.942771000" } ], "filename": "settings", "filenames": [ "settings" ], "transfers": [ { "url": "http://www.tippingpointhampstead.com/api/1/performance/settings", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 107, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 11073, "response_frame": 11147 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2960, "artifact_id": "artifact-a4f77dc712c653f768bd4792", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2960, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2960, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "94ca7571e726c88c0bf98a9a000cbd6b", "sha1": "aebe06e504a54a7c29ac65c01f4be9cb0ec18447", "type": "http-exported-object", "sha256": "1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015", "evidence": [ { "tcp_stream": 133, "frame_number": 13011, "display_filter": "frame.number == 13011", "timestamp_epoch": "1580346261.232398000" } ], "filename": "settings(1)", "filenames": [ "settings(1)" ], "transfers": [ { "url": "http://www.tippingpointhampstead.com/api/1/performance/settings", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 133, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12979, "response_frame": 13011 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2959, "artifact_id": "artifact-e007342cdc12fcb068f729b6", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2959, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2959, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f4cbc7131de17d33379bc12f54c4a6e9", "sha1": "853e00de12e678a55c85f8c33f371ce259779066", "type": "http-exported-object", "sha256": "6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09", "evidence": [ { "tcp_stream": 134, "frame_number": 13395, "display_filter": "frame.number == 13395", "timestamp_epoch": "1580346261.656638000" } ], "filename": "vt%3fpb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&", "filenames": [ "vt%3fpb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 134, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13366, "response_frame": 13395 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2842, "artifact_id": "artifact-22939b0acd0e93c3f26382e4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2842, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2842, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b6b85d812586384c6d7e37ea1973256d", "sha1": "1a4cbccac5fbc3ec33a382f367b42a55d9acdc64", "type": "http-exported-object", "sha256": "7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55", "evidence": [ { "tcp_stream": 146, "frame_number": 13400, "display_filter": "frame.number == 13400", "timestamp_epoch": "1580346261.664745000" } ], "filename": "vt%3fpb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&", "filenames": [ "vt%3fpb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 146, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13377, "response_frame": 13400 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2818, "artifact_id": "artifact-afe22d67bdfe5e4dba8c2874", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2818, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2818, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "63c3fec43ca067c2ca4d3cbe2c4ef8d4", "sha1": "36b3b22d436084515e791a3bc3da016a43c1fdb3", "type": "http-exported-object", "sha256": "e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f", "evidence": [], "filename": "records", "filenames": [ "records" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2385, "artifact_id": "artifact-565889902dcb04545864a893", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2385, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f60c34ea8550c8f2f78c0d09c46f95b7", "sha1": "58df7280e0296813c71091c6a59de1d05f9974c3", "type": "http-exported-object", "sha256": "431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b", "evidence": [], "filename": "%3fLinkID=252669&clcid=0x409(1)", "filenames": [ "%3fLinkID=252669&clcid=0x409(1)", "metadata(2).svc" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2048, "artifact_id": "artifact-177b54e43a4d873568d25252", "occurrences": 2, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2048, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "bb5e186a80a30fd0bae72a0da4345502", "sha1": "100452357f7a102abcdfc4106976fd828949d90e", "type": "http-exported-object", "sha256": "a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa", "evidence": [ { "tcp_stream": 137, "frame_number": 13383, "display_filter": "frame.number == 13383", "timestamp_epoch": "1580346261.635076000" } ], "filename": "vt%3fpb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&", "filenames": [ "vt%3fpb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 137, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13362, "response_frame": 13383 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1836, "artifact_id": "artifact-84b1ff9f748ddaed2b397506", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1836, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1836, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "22a664c1a95eb79364651c6106190cfe", "sha1": "a77ae6d345257c7367c5c1822e1d38e540988e8e", "type": "http-exported-object", "sha256": "9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37", "evidence": [ { "tcp_stream": 24, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1580345696.140205000" } ], "filename": "metadata(3).svc", "filenames": [ "metadata(3).svc" ], "transfers": [ { "url": "http://dmd.metaservices.microsoft.com/metadata.svc", "client_ip": "10.20.30.227", "server_ip": "40.67.249.61", "tcp_stream": 24, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 531, "response_frame": 606 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1734, "artifact_id": "artifact-26f46616c499b9c7636b9633", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1734, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1734, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0d3164761ca1d073c0a4ff5f4386648a", "sha1": "296c7d8c4b359bbfa662eb06580f3c0b34421c46", "type": "http-exported-object", "sha256": "53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d", "evidence": [ { "tcp_stream": 24, "frame_number": 509, "display_filter": "frame.number == 509", "timestamp_epoch": "1580345695.771487000" } ], "filename": "metadata(1).svc", "filenames": [ "metadata(1).svc" ], "transfers": [ { "url": "http://dmd.metaservices.microsoft.com/metadata.svc", "client_ip": "10.20.30.227", "server_ip": "40.67.249.61", "tcp_stream": 24, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 506, "response_frame": 509 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1728, "artifact_id": "artifact-13bdb5a40599166836948ad4", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1728, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1728, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "3cfd8e5f5f514fab43ec377c298f060e", "sha1": "ca1f545dbe9a208f3b1537bdb3ef1245f3215254", "type": "http-exported-object", "sha256": "0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942", "evidence": [ { "tcp_stream": 145, "frame_number": 13481, "display_filter": "frame.number == 13481", "timestamp_epoch": "1580346262.088484000" } ], "filename": "google_white5.png", "filenames": [ "google_white5.png" ], "transfers": [ { "url": "http://maps.gstatic.com/mapfiles/api-3/images/google_white5.png", "client_ip": "10.20.30.227", "server_ip": "172.217.2.227", "tcp_stream": 145, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13474, "response_frame": 13481 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 1642, "artifact_id": "artifact-2c425e12a6e0dc17469ef6e1", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1642, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1642, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "085e783aad409211aff58ca693cbd2ce", "sha1": "20200bebc4cd6cbd6a73743472b21c16e7dad903", "type": "http-exported-object", "sha256": "238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88", "evidence": [ { "tcp_stream": 137, "frame_number": 13403, "display_filter": "frame.number == 13403", "timestamp_epoch": "1580346261.692991000" } ], "filename": "vt%3fpb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i4982125._gj3smp&key=[redacted-captured-api-key]&token=[redacted]", "filenames": [ "vt%3fpb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i4982125._gj3smp&key=[redacted-captured-api-key]&token=[redacted]" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 137, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13385, "response_frame": 13403 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1245, "artifact_id": "artifact-c43475fd66fd8a63070ac9f4", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1245, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1245, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "96e99b36f4d9c88f67f7f7bda63d18fc", "sha1": "10eda8bc1feb2e67b563749605af21718cc5d914", "type": "http-exported-object", "sha256": "801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7", "evidence": [], "filename": "%3fLinkID=252669&clcid=0x409", "filenames": [ "%3fLinkID=252669&clcid=0x409", "metadata.svc" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1242, "artifact_id": "artifact-848cd74acaef691dbb6cc4d7", "occurrences": 2, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1242, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "39bd087a11544b4eae680358d488142d", "sha1": "da4e2d247011d7709a542a11200c77bb97aff543", "type": "http-exported-object", "sha256": "a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce", "evidence": [], "filename": "records(1)", "filenames": [ "records(1)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1205, "artifact_id": "artifact-7c48055a95f31e61ae3a81c7", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1205, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "654d28ad233085000fdb641367ca2677", "sha1": "6289ebb0444edff42a941e349cc8ac10d3e18149", "type": "http-exported-object", "sha256": "731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d", "evidence": [], "filename": "RecordHit", "filenames": [ "RecordHit" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1054, "artifact_id": "artifact-0fd0a4a140d694a585677268", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1054, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d0ff997fcee9e1eea1afda36e9404ccd", "sha1": "4b2d1d88b08be3fe84aef68fac5c142b90007e45", "type": "http-exported-object", "sha256": "d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e", "evidence": [ { "tcp_stream": 91, "frame_number": 9927, "display_filter": "frame.number == 9927", "timestamp_epoch": "1580346175.685396000" } ], "filename": "url%3fsa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L", "filenames": [ "url%3fsa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L" ], "transfers": [ { "url": "http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L", "client_ip": "10.20.30.227", "server_ip": "216.58.193.132", "tcp_stream": 91, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 9913, "response_frame": 9927 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 899, "artifact_id": "artifact-115109a099007dec91e827f0", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 899, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 899, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7b415b1a00b8f322eb5971b6030c242f", "sha1": "6b6072f373b072b8f4fffb17813f45e4390f6028", "type": "http-exported-object", "sha256": "39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5", "evidence": [], "filename": "RecordHit(2)", "filenames": [ "RecordHit(2)" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 876, "artifact_id": "artifact-7d90cc909cfd969dd731fea5", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 876, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "db9fcccb5a88f0c8c46b965fdc4b6f6c", "sha1": "b16c75de6ea22d9490c809be5fe929d4c7206468", "type": "http-exported-object", "sha256": "aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0", "evidence": [ { "tcp_stream": 145, "frame_number": 13372, "display_filter": "frame.number == 13372", "timestamp_epoch": "1580346261.606486000" } ], "filename": "spotlight-poi2.png", "filenames": [ "spotlight-poi2.png" ], "transfers": [ { "url": "http://maps.gstatic.com/mapfiles/api-3/images/spotlight-poi2.png", "client_ip": "10.20.30.227", "server_ip": "172.217.2.227", "tcp_stream": 145, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13353, "response_frame": 13372 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 817, "artifact_id": "artifact-848e2af14e365dd28993cd4d", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 817, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 817, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0499a46518a01ddeefbf5a5ec3b94a14", "sha1": "302b4fd4eab8ed1600caba953822744a9a274979", "type": "http-exported-object", "sha256": "a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30", "evidence": [ { "tcp_stream": 147, "frame_number": 13397, "display_filter": "frame.number == 13397", "timestamp_epoch": "1580346261.659601000" } ], "filename": "vt%3fpb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&", "filenames": [ "vt%3fpb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 147, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13379, "response_frame": 13397 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 618, "artifact_id": "artifact-5a71d27828dfb6e237936653", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 618, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 618, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "23c12517a1687713b2182e52a411aaed", "sha1": "80153d1598a1b9c94cd2b9617d9beb7e18ec93fb", "type": "http-exported-object", "sha256": "b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00", "evidence": [ { "tcp_stream": 57, "frame_number": 1253, "display_filter": "frame.number == 1253", "timestamp_epoch": "1580345759.043889000" } ], "filename": "forum(1).php", "filenames": [ "forum(1).php" ], "transfers": [ { "url": "http://twereptale.com/4/forum.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 57, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1251, "response_frame": 1253 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 436, "artifact_id": "artifact-97da2e42497361f31f6d33f8", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 436, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 436, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "f9e1edd96c64ae92252793a474e40d3f", "sha1": "6ad289122022ffeee9cec71f5f9d5e8a3e7ab3f3", "type": "http-exported-object", "sha256": "93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6", "evidence": [ { "tcp_stream": 135, "frame_number": 13387, "display_filter": "frame.number == 13387", "timestamp_epoch": "1580346261.640060000" } ], "filename": "vt%3fpb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&", "filenames": [ "vt%3fpb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13360, "response_frame": 13387 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 364, "artifact_id": "artifact-fa42fa4f9097cff6d9a67854", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 364, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 364, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "feff9159f56cb2069041d660b484eb07", "sha1": "0d0a08cf25a258511957f357b89d3908f3c5e6e3", "type": "http-exported-object", "sha256": "7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7", "evidence": [ { "tcp_stream": 138, "frame_number": 13225, "display_filter": "frame.number == 13225", "timestamp_epoch": "1580346261.532006000" } ], "filename": "openhand_8_8.cur", "filenames": [ "openhand_8_8.cur" ], "transfers": [ { "url": "http://maps.gstatic.com/mapfiles/openhand_8_8.cur", "client_ip": "10.20.30.227", "server_ip": "172.217.2.227", "tcp_stream": 138, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13191, "response_frame": 13225 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 326, "artifact_id": "artifact-a1efa2acb4d1a9ffc68a8e64", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 326, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 326, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5a014414b96edc2183523931a8826cc0", "sha1": "3370d2855535d2494fd22f21b1da190e13c83a39", "type": "http-exported-object", "sha256": "48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f", "evidence": [], "filename": "RecordEvent", "filenames": [ "RecordEvent" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 314, "artifact_id": "artifact-1bd1c05c0802e610d55502e6", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 314, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "10a37c7498a8eed2c6b8bbf9f3109f08", "sha1": "f7a929b2bfdf9b0eb790f167e50ea69a862e0e87", "type": "http-exported-object", "sha256": "064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df", "evidence": [], "filename": "form-render", "filenames": [ "form-render" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 247, "artifact_id": "artifact-adf8586b3e677e39875ddac7", "occurrences": 1, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 247, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "68a006996ece55adef2db478ed631ea5", "sha1": "43c3c326039fde13b0473b08d729e6fcd7c643b3", "type": "http-exported-object", "sha256": "f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200", "evidence": [ { "tcp_stream": 91, "frame_number": 8233, "display_filter": "frame.number == 8233", "timestamp_epoch": "1580346162.842756000" } ], "filename": "%2f(2)", "filenames": [ "%2f(2)" ], "transfers": [ { "url": "http://www.google.com/", "client_ip": "10.20.30.227", "server_ip": "216.58.193.132", "tcp_stream": 91, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "302", "completeness": "matches-declared-content-length", "request_frame": 8231, "response_frame": 8233 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 231, "artifact_id": "artifact-7f7c1d5d8c7842e16cbf08fd", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 231, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 231, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d4b691cd9d99117b2ea34586d3e7eeb8", "sha1": "c79f5572f672361bc097676cb5da9d4aa956c8b9", "type": "http-exported-object", "sha256": "2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de", "evidence": [ { "tcp_stream": 89, "frame_number": 8224, "display_filter": "frame.number == 8224", "timestamp_epoch": "1580346162.763305000" } ], "filename": "%2f(1)", "filenames": [ "%2f(1)" ], "transfers": [ { "url": "http://google.com/", "client_ip": "10.20.30.227", "server_ip": "216.58.194.46", "tcp_stream": 89, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "301", "completeness": "matches-declared-content-length", "request_frame": 8222, "response_frame": 8224 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 219, "artifact_id": "artifact-587654a3571a2e5d57931b4b", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 219, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 219, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "7a1b068c195fae4653d247f5d228f82f", "sha1": "8ae3aa2ad18f857b3b19573dbf2e81a5caebdc9e", "type": "http-exported-object", "sha256": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "evidence": [], "filename": "forum(3).php", "filenames": [ "forum(3).php", "forum(5).php", "forum(7).php", "forum(9).php", "forum.php" ], "transfers": [], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 135, "artifact_id": "artifact-47c1246c71f0933b5374450e", "occurrences": 5, "completeness": "unknown", "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 135, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "8327a6037ae00a5be9f75e63ee1b9fbe", "sha1": "a812c79b0d125e4946b33446eae0353f518627e2", "type": "http-exported-object", "sha256": "fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588", "evidence": [ { "tcp_stream": 138, "frame_number": 13359, "display_filter": "frame.number == 13359", "timestamp_epoch": "1580346261.583906000" } ], "filename": "transparent.png", "filenames": [ "transparent.png" ], "transfers": [ { "url": "http://maps.gstatic.com/mapfiles/transparent.png", "client_ip": "10.20.30.227", "server_ip": "172.217.2.227", "tcp_stream": 138, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 13302, "response_frame": 13359 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "image/png", "size_bytes": 68, "artifact_id": "artifact-e89ce659257476841be85609", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 68, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 68, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "652ab4ef2a3326ce45feeb1e2bee9d60", "sha1": "961f8c55b11a9a9f9276fe5c401cb0a56c40e763", "type": "http-exported-object", "sha256": "b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e", "evidence": [ { "tcp_stream": 146, "frame_number": 13503, "display_filter": "frame.number == 13503", "timestamp_epoch": "1580346262.108595000" } ], "filename": "QuotaService.RecordEvent%3f1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]", "filenames": [ "QuotaService.RecordEvent%3f1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 146, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13477, "response_frame": 13503 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 62, "artifact_id": "artifact-848f143969abccce439ee94c", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 62, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 62, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "2c86c7d21ca528c834ee4cf219f639fa", "sha1": "39bf8430f0fc8cc6cbfd74b68cfa9e3e423798ae", "type": "http-exported-object", "sha256": "fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774", "evidence": [ { "tcp_stream": 146, "frame_number": 13468, "display_filter": "frame.number == 13468", "timestamp_epoch": "1580346261.991958000" } ], "filename": "AuthenticationService.Authenticate%3f1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]", "filenames": [ "AuthenticationService.Authenticate%3f1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]" ], "transfers": [ { "url": "http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]", "client_ip": "10.20.30.227", "server_ip": "172.217.9.170", "tcp_stream": 146, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 13409, "response_frame": 13468 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 62, "artifact_id": "artifact-a34e16097b660ca4c191f23e", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 62, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 62, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "a71875fce43962cc81991aa859eebcb1", "sha1": "a7da437ddbf372d3399fcf5f214c218f99a9dfde", "type": "http-exported-object", "sha256": "fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d", "evidence": [ { "tcp_stream": 59, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1580345761.029550000" } ], "filename": "forum(2).php", "filenames": [ "forum(2).php" ], "transfers": [ { "url": "http://twereptale.com/mlu/forum.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 59, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 1315, "response_frame": 1317 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 20, "artifact_id": "artifact-8ffd02698e25fb284f26fe22", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 20, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 20, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "5b64e8b89092b2e3dfd448b10700627f", "sha1": "484b3032619fa1acd135d114565b0a5166281c22", "type": "http-exported-object", "sha256": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "evidence": [ { "tcp_stream": 106, "frame_number": 11473, "display_filter": "frame.number == 11473", "timestamp_epoch": "1580346177.025222000" }, { "tcp_stream": 129, "frame_number": 12980, "display_filter": "frame.number == 12980", "timestamp_epoch": "1580346261.183847000" }, { "tcp_stream": 132, "frame_number": 12992, "display_filter": "frame.number == 12992", "timestamp_epoch": "1580346261.219547000" }, { "tcp_stream": 128, "frame_number": 13037, "display_filter": "frame.number == 13037", "timestamp_epoch": "1580346261.257522000" } ], "filename": "RecordEvent(1)", "filenames": [ "RecordEvent(1)", "RecordHit(1)", "RecordHit(3)", "form-render(1)" ], "transfers": [ { "url": "http://www.tippingpointhampstead.com/api/census/RecordHit", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 106, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 11070, "response_frame": 11473 }, { "url": "http://www.tippingpointhampstead.com/api/events/RecordEvent", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 129, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12960, "response_frame": 12980 }, { "url": "http://www.tippingpointhampstead.com/api/census/form-render", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 132, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12962, "response_frame": 12992 }, { "url": "http://www.tippingpointhampstead.com/api/census/RecordHit", "client_ip": "10.20.30.227", "server_ip": "198.185.159.144", "tcp_stream": 128, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12957, "response_frame": 13037 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 17, "artifact_id": "artifact-634305e4ada13479869cf960", "occurrences": 4, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 17, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 17, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b52cf3b831ed62037b323b862496dd51", "sha1": "ffe91b2ad0239a338097917b4df63a460e71829a", "type": "http-exported-object", "sha256": "e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5", "evidence": [ { "tcp_stream": 56, "frame_number": 1244, "display_filter": "frame.number == 1244", "timestamp_epoch": "1580345758.445237000" } ], "filename": "%2f", "filenames": [ "%2f" ], "transfers": [ { "url": "http://api.ipify.org/", "client_ip": "10.20.30.227", "server_ip": "184.73.165.106", "tcp_stream": 56, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1242, "response_frame": 1244 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 15, "artifact_id": "artifact-db0c9ac1da1bf8667da41a06", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 15, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 15, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "cfead1c7c639d2395cf39be2d9bffab5", "sha1": "9dbf6887663b8a3cee2e2c80d80ed32d9f67e562", "type": "http-exported-object", "sha256": "6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c", "evidence": [ { "tcp_stream": 63, "frame_number": 3589, "display_filter": "frame.number == 3589", "timestamp_epoch": "1580345765.577426000" } ], "filename": "about.php", "filenames": [ "about.php" ], "transfers": [ { "url": "http://twereptale.com/d2/about.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 63, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 3586, "response_frame": 3589 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 13, "artifact_id": "artifact-0c219fd0a08558a4ea167088", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 13, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 13, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "334f2493d31a558d30ebda0259b396aa", "sha1": "030364f097f19f4abb8ff27162d8326ac5418753", "type": "http-exported-object", "sha256": "6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d", "evidence": [ { "tcp_stream": 80, "frame_number": 7918, "display_filter": "frame.number == 7918", "timestamp_epoch": "1580346126.063592000" } ], "filename": "forum(8).php", "filenames": [ "forum(8).php" ], "transfers": [ { "url": "http://twereptale.com/4/forum.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 80, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 7916, "response_frame": 7918 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12, "artifact_id": "artifact-c1dc13c7b3e294b871f9b46b", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "caf53bc088dff3bfa04cf496ad23f9f0", "sha1": "876cbd260187e68225bd7c41b8f1a470810b8790", "type": "http-exported-object", "sha256": "866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72", "evidence": [ { "tcp_stream": 76, "frame_number": 7825, "display_filter": "frame.number == 7825", "timestamp_epoch": "1580346005.690328000" } ], "filename": "forum(6).php", "filenames": [ "forum(6).php" ], "transfers": [ { "url": "http://twereptale.com/4/forum.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 76, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 7823, "response_frame": 7825 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12, "artifact_id": "artifact-8bad7b86c1c0341b2963a040", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "25925f7fea5bf95a6a37a45346dacc0b", "sha1": "a3edf4caac4ea503e88de757cb5e5a5fa6772d56", "type": "http-exported-object", "sha256": "8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36", "evidence": [ { "tcp_stream": 127, "frame_number": 12857, "display_filter": "frame.number == 12857", "timestamp_epoch": "1580346246.475071000" } ], "filename": "forum(10).php", "filenames": [ "forum(10).php" ], "transfers": [ { "url": "http://twereptale.com/4/forum.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 127, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 12855, "response_frame": 12857 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12, "artifact_id": "artifact-52150bce76eb1a2a520dfa21", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d3d241f1f7a282a3e7f8c9037d36d46d", "sha1": "0d3f38ebbd11bde884d38953e48623c1a08fc0a7", "type": "http-exported-object", "sha256": "909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e", "evidence": [ { "tcp_stream": 70, "frame_number": 7713, "display_filter": "frame.number == 7713", "timestamp_epoch": "1580345885.300907000" } ], "filename": "forum(4).php", "filenames": [ "forum(4).php" ], "transfers": [ { "url": "http://twereptale.com/4/forum.php", "client_ip": "10.20.30.227", "server_ip": "81.177.6.156", "tcp_stream": 70, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "unknown", "request_frame": 7711, "response_frame": 7713 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 12, "artifact_id": "artifact-c0da0904f71a67fb8d0c6824", "occurrences": 1, "completeness": "unknown", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 12, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 12, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "10.20.30.1", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-8dc0598f73d599aa8fe823a4", "packets_sent": 0, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 3138, "evidence_frames": [ 1, 2, 278, 279, 280 ], "last_seen_epoch": "1580346178.667654", "first_seen_epoch": "1580345692.299272", "packets_received": 30 }, { "ip": "10.20.30.2", "bytes_sent": 792590, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-b56d729b1b5dd831ae966076", "packets_sent": 3670, "mac_addresses": [ "00:19:b9:fa:14:e6" ], "bytes_received": 1973644, "evidence_frames": [ 3, 4, 5, 6, 7 ], "last_seen_epoch": "1580346262.083115", "first_seen_epoch": "1580345692.505473", "packets_received": 3748 }, { "ip": "10.20.30.227", "bytes_sent": 2206481, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-a77168928814c5d7dbc0cb9d", "packets_sent": 5412, "mac_addresses": [ "58:94:6b:77:9b:3c" ], "bytes_received": 6186833, "evidence_frames": [ 1, 2, 3, 4, 5 ], "last_seen_epoch": "1580346262.149261", "first_seen_epoch": "1580345692.299272", "packets_received": 8092 }, { "ip": "10.20.30.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-5c9d611396e55811d812d794", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 4014, "evidence_frames": [ 609, 610, 611, 612, 613 ], "last_seen_epoch": "1580346181.763084", "first_seen_epoch": "1580345696.847984", "packets_received": 38 }, { "ip": "104.81.85.107", "bytes_sent": 140577, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6f14f975545e19d719beca2b", "packets_sent": 142, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 11621, "evidence_frames": [ 9968, 9974, 9975, 9976, 9977 ], "last_seen_epoch": "1580346261.226034", "first_seen_epoch": "1580346175.991446", "packets_received": 83 }, { "ip": "104.97.213.249", "bytes_sent": 815812, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6646cfbf3ec9d13b508ff204", "packets_sent": 557, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 7811, "evidence_frames": [ 9970, 9971, 9972, 9973, 9983 ], "last_seen_epoch": "1580346221.10904", "first_seen_epoch": "1580346175.997589", "packets_received": 110 }, { "ip": "13.107.246.10", "bytes_sent": 7766, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-99800da97e63ecdb80bc7fd7", "packets_sent": 17, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 2797, "evidence_frames": [ 7673, 7675, 7676, 7677, 7678 ], "last_seen_epoch": "1580345871.095843", "first_seen_epoch": "1580345870.818905", "packets_received": 12 }, { "ip": "13.107.246.254", "bytes_sent": 6477, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-cf6d0dc8b42367e48eeab710", "packets_sent": 15, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1600, "evidence_frames": [ 8116, 8117, 8118, 8119, 8120 ], "last_seen_epoch": "1580346153.254223", "first_seen_epoch": "1580346153.166215", "packets_received": 13 }, { "ip": "13.107.3.128", "bytes_sent": 8152, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8af53952c8e29b0cb54af200", "packets_sent": 16, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1980, "evidence_frames": [ 7949, 7950, 7951, 7952, 7953 ], "last_seen_epoch": "1580346261.937089", "first_seen_epoch": "1580346136.091254", "packets_received": 13 }, { "ip": "13.107.42.254", "bytes_sent": 6198, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9d3ed62ea67a833f5656146b", "packets_sent": 15, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1600, "evidence_frames": [ 8146, 8147, 8148, 8149, 8150 ], "last_seen_epoch": "1580346153.362845", "first_seen_epoch": "1580346153.281373", "packets_received": 13 }, { "ip": "13.107.6.158", "bytes_sent": 7800, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a58218d193c5e710772c45f5", "packets_sent": 20, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 2114, "evidence_frames": [ 8441, 8582, 8584, 8591, 8592 ], "last_seen_epoch": "1580346261.262085", "first_seen_epoch": "1580346163.430586", "packets_received": 15 }, { "ip": "148.66.137.40", "bytes_sent": 98035, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-d7679634dd7500507e0f4697", "packets_sent": 70, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 2052, "evidence_frames": [ 1257, 1258, 1259, 1260, 1261 ], "last_seen_epoch": "1580345764.89901", "first_seen_epoch": "1580345759.143023", "packets_received": 31 }, { "ip": "151.101.0.238", "bytes_sent": 2335752, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f2405f418f7b66e851008167", "packets_sent": 1596, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 20739, "evidence_frames": [ 9982, 9984, 9986, 10002, 10003 ], "last_seen_epoch": "1580346222.53078", "first_seen_epoch": "1580346176.010364", "packets_received": 265 }, { "ip": "172.217.1.238", "bytes_sent": 79132, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-becd6edf376c66fa8195953f", "packets_sent": 75, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 4602, "evidence_frames": [ 8773, 8774, 8775, 8776, 8777 ], "last_seen_epoch": "1580346254.141693", "first_seen_epoch": "1580346163.928895", "packets_received": 37 }, { "ip": "172.217.12.46", "bytes_sent": 89954, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-99a58af301eb5b326976cc2e", "packets_sent": 71, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 3548, "evidence_frames": [ 13197, 13198, 13199, 13200, 13205 ], "last_seen_epoch": "1580346261.603123", "first_seen_epoch": "1580346261.517102", "packets_received": 34 }, { "ip": "172.217.14.163", "bytes_sent": 137015, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f1b5aea764195915a3fc1288", "packets_sent": 124, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 7868, "evidence_frames": [ 8370, 8371, 8381, 8382, 8383 ], "last_seen_epoch": "1580346262.105428", "first_seen_epoch": "1580346163.361119", "packets_received": 68 }, { "ip": "172.217.14.170", "bytes_sent": 2668, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-50b9e133dc0a761da3b73489", "packets_sent": 5, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1192, "evidence_frames": [ 9981, 10014, 10015, 10016, 10017 ], "last_seen_epoch": "1580346262.103976", "first_seen_epoch": "1580346176.010041", "packets_received": 7 }, { "ip": "172.217.2.227", "bytes_sent": 4863, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-195f2ce95424cdb6570b63fa", "packets_sent": 11, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 2266, "evidence_frames": [ 13186, 13189, 13190, 13191, 13192 ], "last_seen_epoch": "1580346262.088602", "first_seen_epoch": "1580346261.491338", "packets_received": 11 }, { "ip": "172.217.2.238", "bytes_sent": 44267, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-00730864094054ca270978ef", "packets_sent": 34, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1666, "evidence_frames": [ 13195, 13196, 13201, 13202, 13203 ], "last_seen_epoch": "1580346261.56228", "first_seen_epoch": "1580346261.516493", "packets_received": 15 }, { "ip": "172.217.9.1", "bytes_sent": 35222, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5fa7d9a83d10f7807ced3b8b", "packets_sent": 37, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 2450, "evidence_frames": [ 9320, 9330, 9331, 9332, 9333 ], "last_seen_epoch": "1580346219.437253", "first_seen_epoch": "1580346173.079145", "packets_received": 18 }, { "ip": "172.217.9.170", "bytes_sent": 250289, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-74766e8414ca338ae21fc288", "packets_sent": 202, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 15176, "evidence_frames": [ 12985, 12987, 12988, 12989, 12990 ], "last_seen_epoch": "1580346262.149261", "first_seen_epoch": "1580346261.194396", "packets_received": 97 }, { "ip": "172.217.9.3", "bytes_sent": 140130, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1e2ee342d1729b72c10f52bf", "packets_sent": 113, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 4120, "evidence_frames": [ 8415, 8431, 8432, 8433, 8434 ], "last_seen_epoch": "1580346218.608952", "first_seen_epoch": "1580346163.409634", "packets_received": 42 }, { "ip": "184.73.165.106", "bytes_sent": 461, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9f015e1374be2be558032822", "packets_sent": 5, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 500, "evidence_frames": [ 1239, 1240, 1241, 1242, 1243 ], "last_seen_epoch": "1580345868.311551", "first_seen_epoch": "1580345758.363377", "packets_received": 6 }, { "ip": "198.185.159.144", "bytes_sent": 32106, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a047a80e4ecd87f42c2f9c14", "packets_sent": 54, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 16209, "evidence_frames": [ 9942, 9943, 9947, 9948, 9949 ], "last_seen_epoch": "1580346261.297288", "first_seen_epoch": "1580346175.82597", "packets_received": 46 }, { "ip": "204.79.197.200", "bytes_sent": 14495, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-23bf95249144eb7a67e9eff4", "packets_sent": 39, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 10984, "evidence_frames": [ 971, 972, 973, 974, 975 ], "last_seen_epoch": "1580346149.700693", "first_seen_epoch": "1580345708.619795", "packets_received": 34 }, { "ip": "204.79.197.222", "bytes_sent": 8084, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-aa47ee3c46be084a7dc25742", "packets_sent": 16, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1977, "evidence_frames": [ 8088, 8089, 8090, 8091, 8092 ], "last_seen_epoch": "1580346153.482468", "first_seen_epoch": "1580346150.992246", "packets_received": 14 }, { "ip": "204.79.197.254", "bytes_sent": 6145, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-93952cef843f6c0c03f9cddf", "packets_sent": 14, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1546, "evidence_frames": [ 8176, 8177, 8178, 8179, 8180 ], "last_seen_epoch": "1580346153.466568", "first_seen_epoch": "1580346153.384202", "packets_received": 12 }, { "ip": "216.58.193.130", "bytes_sent": 12519, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8f7347a1d6380a2a77e25c36", "packets_sent": 37, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 4853, "evidence_frames": [ 8900, 8901, 8902, 8903, 8904 ], "last_seen_epoch": "1580346254.453799", "first_seen_epoch": "1580346164.191242", "packets_received": 31 }, { "ip": "216.58.193.132", "bytes_sent": 940137, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-4f22c5c870b15e66a326b1b7", "packets_sent": 854, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 35517, "evidence_frames": [ 8227, 8229, 8230, 8231, 8232 ], "last_seen_epoch": "1580346260.272926", "first_seen_epoch": "1580346162.797119", "packets_received": 299 }, { "ip": "216.58.194.131", "bytes_sent": 13203, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3ca636e30f271720f4629731", "packets_sent": 18, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1703, "evidence_frames": [ 8347, 8349, 8352, 8353, 8354 ], "last_seen_epoch": "1580346253.390787", "first_seen_epoch": "1580346163.293816", "packets_received": 12 }, { "ip": "216.58.194.46", "bytes_sent": 914, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-09d23a1a85600799c516f88e", "packets_sent": 7, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1000, "evidence_frames": [ 8216, 8217, 8218, 8219, 8220 ], "last_seen_epoch": "1580346252.766466", "first_seen_epoch": "1580346162.726499", "packets_received": 10 }, { "ip": "216.58.194.78", "bytes_sent": 6105, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-27b122b1c2180ef66ab1ebb7", "packets_sent": 15, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 2670, "evidence_frames": [ 8971, 8972, 8973, 8974, 8975 ], "last_seen_epoch": "1580346255.031939", "first_seen_epoch": "1580346164.942978", "packets_received": 13 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-43ea55ff1180bad18a469853", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 108, "evidence_frames": [ 935, 939 ], "last_seen_epoch": "1580345705.566754", "first_seen_epoch": "1580345705.300961", "packets_received": 2 }, { "ip": "224.0.0.251", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-66753c0c02e81a0dc85d9f0e", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fb" ], "bytes_received": 1340, "evidence_frames": [ 7925, 7933, 7941, 7945, 7947 ], "last_seen_epoch": "1580346176.658991", "first_seen_epoch": "1580346133.536248", "packets_received": 18 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6b3efc4e2fc531a6335e3d87", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 1068, "evidence_frames": [ 7926, 7930, 7942, 7943, 8005 ], "last_seen_epoch": "1580346176.082359", "first_seen_epoch": "1580346133.536724", "packets_received": 16 }, { "ip": "23.51.186.146", "bytes_sent": 1248, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-50f6459fce4726b5c7e90cc2", "packets_sent": 12, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 4708, "evidence_frames": [ 485, 488, 489, 490, 491 ], "last_seen_epoch": "1580345695.892043", "first_seen_epoch": "1580345695.265101", "packets_received": 13 }, { "ip": "239.255.255.250", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-9797f71f375ce15a3e2b53e6", "packets_sent": 0, "mac_addresses": [ "01:00:5e:7f:ff:fa" ], "bytes_received": 3152, "evidence_frames": [ 7927, 7934, 7944, 7974, 7976 ], "last_seen_epoch": "1580346256.499874", "first_seen_epoch": "1580346133.604864", "packets_received": 16 }, { "ip": "40.126.0.67", "bytes_sent": 5995, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5b5ad6ecd3ade52fd85c464c", "packets_sent": 10, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1431, "evidence_frames": [ 1124, 1125, 1126, 1127, 1128 ], "last_seen_epoch": "1580345752.568999", "first_seen_epoch": "1580345751.5048", "packets_received": 9 }, { "ip": "40.67.249.61", "bytes_sent": 4734, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-02c0070631e9c9b83963780f", "packets_sent": 10, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 4520, "evidence_frames": [ 501, 502, 503, 504, 505 ], "last_seen_epoch": "1580345741.155491", "first_seen_epoch": "1580345695.401455", "packets_received": 10 }, { "ip": "49.51.133.162", "bytes_sent": 85522, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-b8595a8ec5c8845051e57d74", "packets_sent": 62, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 938, "evidence_frames": [ 1166, 1167, 1168, 1169, 1170 ], "last_seen_epoch": "1580345867.235598", "first_seen_epoch": "1580345757.527582", "packets_received": 13 }, { "ip": "52.109.76.30", "bytes_sent": 7273, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-408af4fd35e9fbb68196c18b", "packets_sent": 13, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 1612, "evidence_frames": [ 7725, 7726, 7727, 7728, 7729 ], "last_seen_epoch": "1580346094.407569", "first_seen_epoch": "1580345984.338131", "packets_received": 9 }, { "ip": "52.114.132.22", "bytes_sent": 16169, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6de08755207c2b02e0d58261", "packets_sent": 40, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 15714, "evidence_frames": [ 1358, 1391, 1392, 1398, 1399 ], "last_seen_epoch": "1580346113.981937", "first_seen_epoch": "1580345761.098053", "packets_received": 39 }, { "ip": "52.114.75.79", "bytes_sent": 14645, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-448daec9381d865210812564", "packets_sent": 31, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 7946, "evidence_frames": [ 731, 795, 796, 800, 801 ], "last_seen_epoch": "1580346134.007401", "first_seen_epoch": "1580345703.936437", "packets_received": 25 }, { "ip": "52.242.211.89", "bytes_sent": 10799, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3d7809cec93160dd5e0bdfae", "packets_sent": 32, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 5748, "evidence_frames": [ 938, 940, 941, 942, 943 ], "last_seen_epoch": "1580345870.826447", "first_seen_epoch": "1580345705.538625", "packets_received": 25 }, { "ip": "81.177.6.156", "bytes_sent": 3580, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-edcf20647b1f28d2413c4cb4", "packets_sent": 33, "mac_addresses": [ "00:04:c0:94:66:d5" ], "bytes_received": 5239, "evidence_frames": [ 1248, 1249, 1250, 1251, 1252 ], "last_seen_epoch": "1580346246.47542", "first_seen_epoch": "1580345758.669774", "packets_received": 40 } ], "identities": [ { "type": "account", "value": "alejandrina.hogue", "bindings": [ { "account": "", "owner_ip": "10.20.30.227", "frame_number": 702, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 710, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 712, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 724, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 744, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 787, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "alejandrina.hogue", "owner_ip": null, "frame_number": 821, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 852, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 864, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" } ], "evidence": [ { "tcp_stream": 35, "frame_number": 702, "display_filter": "frame.number == 702", "timestamp_epoch": "1580345703.601735000" }, { "tcp_stream": 36, "frame_number": 710, "display_filter": "frame.number == 710", "timestamp_epoch": "1580345703.613736000" }, { "tcp_stream": 36, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1580345703.614372000" }, { "tcp_stream": 37, "frame_number": 724, "display_filter": "frame.number == 724", "timestamp_epoch": "1580345703.621463000" }, { "tcp_stream": 39, "frame_number": 744, "display_filter": "frame.number == 744", "timestamp_epoch": "1580345703.960107000" }, { "tcp_stream": 40, "frame_number": 787, "display_filter": "frame.number == 787", "timestamp_epoch": "1580345704.030808000" }, { "tcp_stream": 40, "frame_number": 821, "display_filter": "frame.number == 821", "timestamp_epoch": "1580345704.172301000" }, { "tcp_stream": 43, "frame_number": 852, "display_filter": "frame.number == 852", "timestamp_epoch": "1580345704.209310000" }, { "tcp_stream": 44, "frame_number": 864, "display_filter": "frame.number == 864", "timestamp_epoch": "1580345704.210588000" } ], "raw_values": [ "alejandrina.hogue" ], "identity_id": "identity-0be037907c3b2a691e097a63", "ip_addresses": [ "10.20.30.227" ], "mac_addresses": [ "58:94:6b:77:9b:3c" ] }, { "type": "account", "value": "desktop-4c02emg$", "bindings": [ { "account": "", "owner_ip": "10.20.30.227", "frame_number": 18, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 46, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 48, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 66, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 78, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 86, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 88, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 105, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 120, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 204, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 216, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 300, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 328, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 340, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 659, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 667, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 669, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 681, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" } ], "evidence": [ { "tcp_stream": 0, "frame_number": 18, "display_filter": "frame.number == 18", "timestamp_epoch": "1580345692.775911000" }, { "tcp_stream": 3, "frame_number": 46, "display_filter": "frame.number == 46", "timestamp_epoch": "1580345692.804319000" }, { "tcp_stream": 3, "frame_number": 48, "display_filter": "frame.number == 48", "timestamp_epoch": "1580345692.805580000" }, { "tcp_stream": 5, "frame_number": 66, "display_filter": "frame.number == 66", "timestamp_epoch": "1580345692.824226000" }, { "tcp_stream": 6, "frame_number": 78, "display_filter": "frame.number == 78", "timestamp_epoch": "1580345692.831884000" }, { "tcp_stream": 7, "frame_number": 86, "display_filter": "frame.number == 86", "timestamp_epoch": "1580345692.838290000" }, { "tcp_stream": 7, "frame_number": 88, "display_filter": "frame.number == 88", "timestamp_epoch": "1580345692.840021000" }, { "tcp_stream": 8, "frame_number": 105, "display_filter": "frame.number == 105", "timestamp_epoch": "1580345692.847794000" }, { "tcp_stream": 10, "frame_number": 120, "display_filter": "frame.number == 120", "timestamp_epoch": "1580345692.849912000" }, { "tcp_stream": 14, "frame_number": 204, "display_filter": "frame.number == 204", "timestamp_epoch": "1580345693.252877000" }, { "tcp_stream": 15, "frame_number": 216, "display_filter": "frame.number == 216", "timestamp_epoch": "1580345693.254021000" }, { "tcp_stream": 19, "frame_number": 300, "display_filter": "frame.number == 300", "timestamp_epoch": "1580345694.077734000" }, { "tcp_stream": 21, "frame_number": 328, "display_filter": "frame.number == 328", "timestamp_epoch": "1580345694.137019000" }, { "tcp_stream": 22, "frame_number": 340, "display_filter": "frame.number == 340", "timestamp_epoch": "1580345694.138014000" }, { "tcp_stream": 32, "frame_number": 659, "display_filter": "frame.number == 659", "timestamp_epoch": "1580345700.814917000" }, { "tcp_stream": 33, "frame_number": 667, "display_filter": "frame.number == 667", "timestamp_epoch": "1580345700.816040000" }, { "tcp_stream": 33, "frame_number": 669, "display_filter": "frame.number == 669", "timestamp_epoch": "1580345700.816658000" }, { "tcp_stream": 34, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1580345700.826885000" } ], "raw_values": [ "DESKTOP-4C02EMG$", "desktop-4c02emg$" ], "identity_id": "identity-e833aee724780b5246d2b992", "ip_addresses": [ "10.20.30.227" ], "mac_addresses": [ "58:94:6b:77:9b:3c" ] }, { "type": "domain", "value": "SOL-LIGHTNET", "bindings": [ { "account": "", "owner_ip": "10.20.30.227", "frame_number": 787, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" } ], "evidence": [ { "tcp_stream": 40, "frame_number": 787, "display_filter": "frame.number == 787", "timestamp_epoch": "1580345704.030808000" } ], "raw_values": [ "SOL-LIGHTNET" ], "identity_id": "identity-4dbfc44a57d1e0d4d0cedc38", "ip_addresses": [ "10.20.30.227" ], "mac_addresses": [ "58:94:6b:77:9b:3c" ] }, { "type": "full-name", "value": "Alejandrina Hogue", "bindings": [ { "account": "alejandrina.hogue", "owner_ip": "10.20.30.227", "frame_number": 821, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "10.20.30.227", "conversation_src": "10.20.30.2" } ], "evidence": [ { "tcp_stream": 40, "frame_number": 821, "display_filter": "frame.number == 821", "timestamp_epoch": "1580345704.172301000" } ], "raw_values": [ "Alejandrina Hogue" ], "identity_id": "identity-adf6ab9dcde981733c87f500", "ip_addresses": [ "10.20.30.227" ], "mac_addresses": [] }, { "type": "hostname", "value": "DESKTOP-4C02EMG", "bindings": [ { "account": "", "owner_ip": "10.20.30.227", "frame_number": 1, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 278, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 280, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 482, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 486, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 608, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 610, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 611, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 613, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 614, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 616, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 618, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 619, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 622, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 694, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": "10.20.30.227", "frame_number": 7718, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" } ], "evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1580345692.299272000" }, { "udp_stream": 0, "frame_number": 278, "display_filter": "frame.number == 278", "timestamp_epoch": "1580345693.715894000" }, { "udp_stream": 0, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1580345693.800990000" }, { "udp_stream": 0, "frame_number": 482, "display_filter": "frame.number == 482", "timestamp_epoch": "1580345695.207284000" }, { "udp_stream": 0, "frame_number": 486, "display_filter": "frame.number == 486", "timestamp_epoch": "1580345695.300974000" }, { "udp_stream": 0, "frame_number": 608, "display_filter": "frame.number == 608", "timestamp_epoch": "1580345696.722942000" }, { "udp_stream": 20, "frame_number": 610, "display_filter": "frame.number == 610", "timestamp_epoch": "1580345696.848105000" }, { "udp_stream": 20, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1580345697.613563000" }, { "udp_stream": 20, "frame_number": 613, "display_filter": "frame.number == 613", "timestamp_epoch": "1580345698.286821000" }, { "udp_stream": 20, "frame_number": 614, "display_filter": "frame.number == 614", "timestamp_epoch": "1580345698.380049000" }, { "udp_stream": 20, "frame_number": 616, "display_filter": "frame.number == 616", "timestamp_epoch": "1580345699.066670000" }, { "udp_stream": 20, "frame_number": 618, "display_filter": "frame.number == 618", "timestamp_epoch": "1580345699.144893000" }, { "udp_stream": 20, "frame_number": 619, "display_filter": "frame.number == 619", "timestamp_epoch": "1580345699.816791000" }, { "udp_stream": 20, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1580345700.566834000" }, { "udp_stream": 23, "frame_number": 694, "display_filter": "frame.number == 694", "timestamp_epoch": "1580345701.362494000" }, { "udp_stream": 23, "frame_number": 7718, "display_filter": "frame.number == 7718", "timestamp_epoch": "1580345938.809515000" } ], "raw_values": [ "DESKTOP-4C02EMG", "DESKTOP-4C02EMG<00>,DESKTOP-4C02EMG<00> (Workstation/Redirector)", "DESKTOP-4C02EMG<20>,DESKTOP-4C02EMG<20> (Server service)" ], "identity_id": "identity-afe56b16e690814a99f9553e", "ip_addresses": [ "10.20.30.227" ], "mac_addresses": [ "58:94:6b:77:9b:3c" ] }, { "type": "hostname", "value": "DESKTOP-Y6CNQTE", "bindings": [ { "account": "", "owner_ip": "10.20.30.227", "frame_number": 787, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "10.20.30.2", "conversation_src": "10.20.30.227" } ], "evidence": [ { "tcp_stream": 40, "frame_number": 787, "display_filter": "frame.number == 787", "timestamp_epoch": "1580345704.030808000" } ], "raw_values": [ "DESKTOP-Y6CNQTE" ], "identity_id": "identity-0916d5f92d8fbccada470ce3", "ip_addresses": [ "10.20.30.227" ], "mac_addresses": [ "58:94:6b:77:9b:3c" ] }, { "type": "netbios-group", "value": "SOL-LIGHTNET", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 2, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": null, "frame_number": 279, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": null, "frame_number": 487, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.1", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": null, "frame_number": 609, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": null, "frame_number": 612, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": null, "frame_number": 615, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" }, { "account": "", "owner_ip": null, "frame_number": 617, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "10.20.30.255", "conversation_src": "10.20.30.227" } ], "evidence": [ { "udp_stream": 0, "frame_number": 2, "display_filter": "frame.number == 2", "timestamp_epoch": "1580345692.299344000" }, { "udp_stream": 0, "frame_number": 279, "display_filter": "frame.number == 279", "timestamp_epoch": "1580345693.800923000" }, { "udp_stream": 0, "frame_number": 487, "display_filter": "frame.number == 487", "timestamp_epoch": "1580345695.301044000" }, { "udp_stream": 20, "frame_number": 609, "display_filter": "frame.number == 609", "timestamp_epoch": "1580345696.847984000" }, { "udp_stream": 20, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1580345697.613766000" }, { "udp_stream": 20, "frame_number": 615, "display_filter": "frame.number == 615", "timestamp_epoch": "1580345698.380158000" }, { "udp_stream": 20, "frame_number": 617, "display_filter": "frame.number == 617", "timestamp_epoch": "1580345699.144803000" } ], "raw_values": [ "SOL-LIGHTNET<00>,SOL-LIGHTNET<00> (Workstation/Redirector)" ], "identity_id": "identity-0f76762e06dd2c65aeea62ac", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a-ring.msedge.net", "evidence": [ { "udp_stream": 74, "frame_number": 8174, "display_filter": "frame.number == 8174", "timestamp_epoch": "1580346153.371264000" }, { "udp_stream": 74, "frame_number": 8175, "display_filter": "frame.number == 8175", "timestamp_epoch": "1580346153.383388000" }, { "tcp_stream": 88, "frame_number": 8179, "display_filter": "frame.number == 8179", "timestamp_epoch": "1580346153.397126000" } ], "is_private": null, "observable_id": "observable-352941c787870f49d152d39a", "last_seen_epoch": "1580346153.397126000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346153.371264000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "adservice.google.com", "evidence": [ { "udp_stream": 83, "frame_number": 8893, "display_filter": "frame.number == 8893", "timestamp_epoch": "1580346164.163758000" }, { "udp_stream": 83, "frame_number": 8899, "display_filter": "frame.number == 8899", "timestamp_epoch": "1580346164.189103000" }, { "tcp_stream": 100, "frame_number": 8903, "display_filter": "frame.number == 8903", "timestamp_epoch": "1580346164.206635000" } ], "is_private": null, "observable_id": "observable-7b0922aa16931df601564830", "last_seen_epoch": "1580346164.206635000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.163758000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "api.ipify.org", "evidence": [ { "udp_stream": 36, "frame_number": 1237, "display_filter": "frame.number == 1237", "timestamp_epoch": "1580345758.330226000" }, { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" }, { "tcp_stream": 56, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1580345758.403785000" } ], "is_private": null, "observable_id": "observable-23532d2d30d7fd9503541fe3", "last_seen_epoch": "1580345758.403785000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.330226000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "apis.google.com", "evidence": [ { "udp_stream": 81, "frame_number": 8771, "display_filter": "frame.number == 8771", "timestamp_epoch": "1580346163.901003000" }, { "udp_stream": 81, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1580346163.926174000" }, { "tcp_stream": 98, "frame_number": 8776, "display_filter": "frame.number == 8776", "timestamp_epoch": "1580346163.942156000" } ], "is_private": null, "observable_id": "observable-39198b4fd15e2ced82e4f397", "last_seen_epoch": "1580346163.942156000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.901003000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "assets.squarespace.com", "evidence": [ { "udp_stream": 93, "frame_number": 9965, "display_filter": "frame.number == 9965", "timestamp_epoch": "1580346175.977669000" }, { "udp_stream": 93, "frame_number": 9969, "display_filter": "frame.number == 9969", "timestamp_epoch": "1580346175.996891000" }, { "udp_stream": 104, "frame_number": 12898, "display_filter": "frame.number == 12898", "timestamp_epoch": "1580346260.299235000" }, { "udp_stream": 104, "frame_number": 12918, "display_filter": "frame.number == 12918", "timestamp_epoch": "1580346260.328782000" }, { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" }, { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" }, { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" }, { "tcp_stream": 111, "frame_number": 9999, "display_filter": "frame.number == 9999", "timestamp_epoch": "1580346176.012348000" } ], "is_private": null, "observable_id": "observable-6a18d57aab2281a4bf8a0846", "last_seen_epoch": "1580346260.328782000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.977669000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "client.wns.windows.com", "evidence": [ { "udp_stream": 28, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1580345705.324217000" }, { "udp_stream": 28, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1580345705.530620000" }, { "udp_stream": 41, "frame_number": 3466, "display_filter": "frame.number == 3466", "timestamp_epoch": "1580345764.847758000" }, { "udp_stream": 41, "frame_number": 3467, "display_filter": "frame.number == 3467", "timestamp_epoch": "1580345764.848131000" }, { "tcp_stream": 47, "frame_number": 942, "display_filter": "frame.number == 942", "timestamp_epoch": "1580345705.576845000" }, { "tcp_stream": 62, "frame_number": 3471, "display_filter": "frame.number == 3471", "timestamp_epoch": "1580345764.885473000" } ], "is_private": null, "observable_id": "observable-64c74ab1cb8ee8154d9b9000", "last_seen_epoch": "1580345764.885473000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345705.324217000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "config.edge.skype.com", "evidence": [ { "udp_stream": 58, "frame_number": 7946, "display_filter": "frame.number == 7946", "timestamp_epoch": "1580346136.075907000" }, { "udp_stream": 58, "frame_number": 7948, "display_filter": "frame.number == 7948", "timestamp_epoch": "1580346136.088326000" }, { "tcp_stream": 81, "frame_number": 7952, "display_filter": "frame.number == 7952", "timestamp_epoch": "1580346136.114901000" } ], "is_private": null, "observable_id": "observable-00e5184df3441f86bca4c1d3", "last_seen_epoch": "1580346136.114901000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346136.075907000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "desktop-4c02emg.sol-lightnet.com", "evidence": [ { "udp_stream": 14, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1580345694.867230000" }, { "udp_stream": 14, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1580345694.867451000" } ], "is_private": null, "observable_id": "observable-d2fc95d2e48bb4a65704b026", "last_seen_epoch": "1580345694.867451000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345694.867230000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "dmd.metaservices.microsoft.com", "evidence": [ { "udp_stream": 17, "frame_number": 499, "display_filter": "frame.number == 499", "timestamp_epoch": "1580345695.381660000" }, { "udp_stream": 17, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1580345695.400755000" }, { "tcp_stream": 24, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1580345695.523568000" }, { "tcp_stream": 24, "frame_number": 531, "display_filter": "frame.number == 531", "timestamp_epoch": "1580345695.893444000" } ], "is_private": null, "observable_id": "observable-21b202d653f40d2ee5bccbdd", "last_seen_epoch": "1580345695.893444000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.381660000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "edge.microsoft.com", "evidence": [ { "udp_stream": 80, "frame_number": 8416, "display_filter": "frame.number == 8416", "timestamp_epoch": "1580346163.410134000" }, { "udp_stream": 80, "frame_number": 8440, "display_filter": "frame.number == 8440", "timestamp_epoch": "1580346163.429483000" }, { "tcp_stream": 97, "frame_number": 8591, "display_filter": "frame.number == 8591", "timestamp_epoch": "1580346163.451141000" } ], "is_private": null, "observable_id": "observable-554ac719a35c62a670b3f08b", "last_seen_epoch": "1580346163.451141000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.410134000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "ext-cust.squarespace.com", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "is_private": null, "observable_id": "observable-133e893c42eb06b16d76fb65", "last_seen_epoch": "1580346175.824400000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.824400000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "fonts.googleapis.com", "evidence": [ { "udp_stream": 95, "frame_number": 9978, "display_filter": "frame.number == 9978", "timestamp_epoch": "1580346176.007568000" }, { "udp_stream": 95, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1580346176.008821000" }, { "tcp_stream": 113, "frame_number": 10016, "display_filter": "frame.number == 10016", "timestamp_epoch": "1580346176.022922000" }, { "tcp_stream": 113, "frame_number": 13471, "display_filter": "frame.number == 13471", "timestamp_epoch": "1580346262.041421000" } ], "is_private": null, "observable_id": "observable-01b5e544d48a633512931679", "last_seen_epoch": "1580346262.041421000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.007568000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "fonts.gstatic.com", "evidence": [ { "udp_stream": 78, "frame_number": 8359, "display_filter": "frame.number == 8359", "timestamp_epoch": "1580346163.335890000" }, { "udp_stream": 78, "frame_number": 8367, "display_filter": "frame.number == 8367", "timestamp_epoch": "1580346163.359843000" }, { "udp_stream": 105, "frame_number": 12901, "display_filter": "frame.number == 12901", "timestamp_epoch": "1580346260.303439000" }, { "udp_stream": 105, "frame_number": 12919, "display_filter": "frame.number == 12919", "timestamp_epoch": "1580346260.328844000" }, { "tcp_stream": 117, "frame_number": 11080, "display_filter": "frame.number == 11080", "timestamp_epoch": "1580346176.917041000" }, { "tcp_stream": 120, "frame_number": 11111, "display_filter": "frame.number == 11111", "timestamp_epoch": "1580346176.932931000" }, { "tcp_stream": 121, "frame_number": 11122, "display_filter": "frame.number == 11122", "timestamp_epoch": "1580346176.934102000" }, { "tcp_stream": 121, "frame_number": 13483, "display_filter": "frame.number == 13483", "timestamp_epoch": "1580346262.089124000" }, { "tcp_stream": 95, "frame_number": 8385, "display_filter": "frame.number == 8385", "timestamp_epoch": "1580346163.374824000" }, { "tcp_stream": 94, "frame_number": 8387, "display_filter": "frame.number == 8387", "timestamp_epoch": "1580346163.375214000" }, { "tcp_stream": 103, "frame_number": 9223, "display_filter": "frame.number == 9223", "timestamp_epoch": "1580346172.209981000" } ], "is_private": null, "observable_id": "observable-06b23c4cb5b85a0ba4f3641c", "last_seen_epoch": "1580346262.089124000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.335890000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp.msedge.net", "evidence": [ { "udp_stream": 71, "frame_number": 8086, "display_filter": "frame.number == 8086", "timestamp_epoch": "1580346150.978656000" }, { "udp_stream": 71, "frame_number": 8087, "display_filter": "frame.number == 8087", "timestamp_epoch": "1580346150.991621000" }, { "tcp_stream": 85, "frame_number": 8091, "display_filter": "frame.number == 8091", "timestamp_epoch": "1580346151.005528000" } ], "is_private": null, "observable_id": "observable-8694a02741fa1c3a1ac29aa6", "last_seen_epoch": "1580346151.005528000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346150.978656000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "gengrasjeepram.com", "evidence": [ { "udp_stream": 35, "frame_number": 1164, "display_filter": "frame.number == 1164", "timestamp_epoch": "1580345757.280076000" }, { "udp_stream": 35, "frame_number": 1165, "display_filter": "frame.number == 1165", "timestamp_epoch": "1580345757.512836000" }, { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" } ], "is_private": null, "observable_id": "observable-1c2d9ad67374eb96a4245433", "last_seen_epoch": "1580345757.655509000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345757.280076000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "go.microsoft.com", "evidence": [ { "udp_stream": 16, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1580345695.240525000" }, { "udp_stream": 16, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1580345695.260860000" }, { "tcp_stream": 23, "frame_number": 492, "display_filter": "frame.number == 492", "timestamp_epoch": "1580345695.322080000" }, { "tcp_stream": 25, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1580345695.834804000" } ], "is_private": null, "observable_id": "observable-86a05cdaf868673b31338ced", "last_seen_epoch": "1580345695.834804000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.240525000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "google.com", "evidence": [ { "udp_stream": 75, "frame_number": 8214, "display_filter": "frame.number == 8214", "timestamp_epoch": "1580346162.701203000" }, { "udp_stream": 75, "frame_number": 8215, "display_filter": "frame.number == 8215", "timestamp_epoch": "1580346162.725232000" }, { "tcp_stream": 89, "frame_number": 8222, "display_filter": "frame.number == 8222", "timestamp_epoch": "1580346162.739566000" } ], "is_private": null, "observable_id": "observable-efa36f1f7c5cc3a58b745c6a", "last_seen_epoch": "1580346162.739566000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.701203000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "googleads.g.doubleclick.net", "evidence": [ { "udp_stream": 84, "frame_number": 8923, "display_filter": "frame.number == 8923", "timestamp_epoch": "1580346164.281460000" }, { "udp_stream": 84, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1580346164.306160000" }, { "tcp_stream": 101, "frame_number": 8928, "display_filter": "frame.number == 8928", "timestamp_epoch": "1580346164.322115000" } ], "is_private": null, "observable_id": "observable-01397b3867d0839f6aadf409", "last_seen_epoch": "1580346164.322115000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.281460000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "googlehosted.l.googleusercontent.com", "evidence": [ { "udp_stream": 86, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1580346173.078164000" }, { "udp_stream": 87, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1580346174.305768000" } ], "is_private": null, "observable_id": "observable-f3095eefe32959dac62725ac", "last_seen_epoch": "1580346174.305768000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346173.078164000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "gstaticadssl.l.google.com", "evidence": [ { "udp_stream": 78, "frame_number": 8367, "display_filter": "frame.number == 8367", "timestamp_epoch": "1580346163.359843000" }, { "udp_stream": 105, "frame_number": 12919, "display_filter": "frame.number == 12919", "timestamp_epoch": "1580346260.328844000" } ], "is_private": null, "observable_id": "observable-f3b8a2f9ca371f44e72a60e3", "last_seen_epoch": "1580346260.328844000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.359843000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "images.squarespace-cdn.com", "evidence": [ { "udp_stream": 96, "frame_number": 10702, "display_filter": "frame.number == 10702", "timestamp_epoch": "1580346176.092083000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "tcp_stream": 118, "frame_number": 10750, "display_filter": "frame.number == 10750", "timestamp_epoch": "1580346176.136362000" } ], "is_private": null, "observable_id": "observable-7d6eb84ac9550477ad33e80b", "last_seen_epoch": "1580346176.136362000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.092083000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "khm0.googleapis.com", "evidence": [ { "udp_stream": 110, "frame_number": 13183, "display_filter": "frame.number == 13183", "timestamp_epoch": "1580346261.486853000" }, { "udp_stream": 110, "frame_number": 13193, "display_filter": "frame.number == 13193", "timestamp_epoch": "1580346261.515653000" }, { "tcp_stream": 139, "frame_number": 13203, "display_filter": "frame.number == 13203", "timestamp_epoch": "1580346261.528788000" }, { "tcp_stream": 140, "frame_number": 13217, "display_filter": "frame.number == 13217", "timestamp_epoch": "1580346261.530661000" } ], "is_private": null, "observable_id": "observable-4e5bbd1931504fef83fa6f72", "last_seen_epoch": "1580346261.530661000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.486853000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "khm1.googleapis.com", "evidence": [ { "udp_stream": 111, "frame_number": 13184, "display_filter": "frame.number == 13184", "timestamp_epoch": "1580346261.487034000" }, { "udp_stream": 111, "frame_number": 13194, "display_filter": "frame.number == 13194", "timestamp_epoch": "1580346261.515711000" }, { "tcp_stream": 141, "frame_number": 13215, "display_filter": "frame.number == 13215", "timestamp_epoch": "1580346261.530511000" }, { "tcp_stream": 142, "frame_number": 13219, "display_filter": "frame.number == 13219", "timestamp_epoch": "1580346261.530786000" }, { "tcp_stream": 143, "frame_number": 13221, "display_filter": "frame.number == 13221", "timestamp_epoch": "1580346261.530932000" }, { "tcp_stream": 144, "frame_number": 13223, "display_filter": "frame.number == 13223", "timestamp_epoch": "1580346261.531130000" } ], "is_private": null, "observable_id": "observable-fb83fe731f046b43ce6211b3", "last_seen_epoch": "1580346261.531130000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.487034000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "l-ring.msedge.net", "evidence": [ { "udp_stream": 73, "frame_number": 8144, "display_filter": "frame.number == 8144", "timestamp_epoch": "1580346153.261315000" }, { "udp_stream": 73, "frame_number": 8145, "display_filter": "frame.number == 8145", "timestamp_epoch": "1580346153.280341000" }, { "tcp_stream": 87, "frame_number": 8149, "display_filter": "frame.number == 8149", "timestamp_epoch": "1580346153.295097000" } ], "is_private": null, "observable_id": "observable-788473d7dfaf17818c5318e0", "last_seen_epoch": "1580346153.295097000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346153.261315000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "lh4.googleusercontent.com", "evidence": [ { "udp_stream": 87, "frame_number": 9851, "display_filter": "frame.number == 9851", "timestamp_epoch": "1580346174.280018000" }, { "udp_stream": 87, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1580346174.305768000" } ], "is_private": null, "observable_id": "observable-34d721d2c56c9ba1294896bf", "last_seen_epoch": "1580346174.305768000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346174.280018000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "lh5.googleusercontent.com", "evidence": [ { "udp_stream": 86, "frame_number": 9313, "display_filter": "frame.number == 9313", "timestamp_epoch": "1580346173.052547000" }, { "udp_stream": 86, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1580346173.078164000" }, { "tcp_stream": 104, "frame_number": 9332, "display_filter": "frame.number == 9332", "timestamp_epoch": "1580346173.092854000" } ], "is_private": null, "observable_id": "observable-5c0e575fd3a488bd48274963", "last_seen_epoch": "1580346173.092854000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346173.052547000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "login.microsoftonline.com", "evidence": [ { "udp_stream": 32, "frame_number": 1122, "display_filter": "frame.number == 1122", "timestamp_epoch": "1580345751.490053000" }, { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" }, { "tcp_stream": 53, "frame_number": 1127, "display_filter": "frame.number == 1127", "timestamp_epoch": "1580345751.530306000" } ], "is_private": null, "observable_id": "observable-ec12f03882f74e8f09d1c36d", "last_seen_epoch": "1580345751.530306000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.490053000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "maps.google.com", "evidence": [ { "udp_stream": 97, "frame_number": 11075, "display_filter": "frame.number == 11075", "timestamp_epoch": "1580346176.900362000" }, { "udp_stream": 97, "frame_number": 11088, "display_filter": "frame.number == 11088", "timestamp_epoch": "1580346176.923260000" } ], "is_private": null, "observable_id": "observable-16a6b2bc02188c890e1aae9e", "last_seen_epoch": "1580346176.923260000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.900362000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "maps.googleapis.com", "evidence": [ { "udp_stream": 108, "frame_number": 12971, "display_filter": "frame.number == 12971", "timestamp_epoch": "1580346261.170645000" }, { "udp_stream": 108, "frame_number": 12984, "display_filter": "frame.number == 12984", "timestamp_epoch": "1580346261.193361000" }, { "tcp_stream": 134, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1580346261.207430000" }, { "tcp_stream": 134, "frame_number": 13042, "display_filter": "frame.number == 13042", "timestamp_epoch": "1580346261.292989000" }, { "tcp_stream": 135, "frame_number": 13052, "display_filter": "frame.number == 13052", "timestamp_epoch": "1580346261.352193000" }, { "tcp_stream": 137, "frame_number": 13054, "display_filter": "frame.number == 13054", "timestamp_epoch": "1580346261.352375000" }, { "tcp_stream": 136, "frame_number": 13056, "display_filter": "frame.number == 13056", "timestamp_epoch": "1580346261.352557000" }, { "tcp_stream": 135, "frame_number": 13167, "display_filter": "frame.number == 13167", "timestamp_epoch": "1580346261.465995000" }, { "tcp_stream": 137, "frame_number": 13169, "display_filter": "frame.number == 13169", "timestamp_epoch": "1580346261.466132000" }, { "tcp_stream": 135, "frame_number": 13187, "display_filter": "frame.number == 13187", "timestamp_epoch": "1580346261.491507000" }, { "tcp_stream": 135, "frame_number": 13360, "display_filter": "frame.number == 13360", "timestamp_epoch": "1580346261.596304000" }, { "tcp_stream": 137, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1580346261.597334000" }, { "tcp_stream": 136, "frame_number": 13364, "display_filter": "frame.number == 13364", "timestamp_epoch": "1580346261.598688000" }, { "tcp_stream": 134, "frame_number": 13366, "display_filter": "frame.number == 13366", "timestamp_epoch": "1580346261.599495000" }, { "tcp_stream": 146, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1580346261.614212000" }, { "tcp_stream": 147, "frame_number": 13379, "display_filter": "frame.number == 13379", "timestamp_epoch": "1580346261.614438000" }, { "tcp_stream": 137, "frame_number": 13385, "display_filter": "frame.number == 13385", "timestamp_epoch": "1580346261.639565000" }, { "tcp_stream": 137, "frame_number": 13407, "display_filter": "frame.number == 13407", "timestamp_epoch": "1580346261.955338000" }, { "tcp_stream": 146, "frame_number": 13409, "display_filter": "frame.number == 13409", "timestamp_epoch": "1580346261.955975000" }, { "tcp_stream": 146, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1580346262.073117000" } ], "is_private": null, "observable_id": "observable-96e58356fa588495fd30b76a", "last_seen_epoch": "1580346262.073117000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.170645000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "maps.gstatic.com", "evidence": [ { "udp_stream": 109, "frame_number": 13171, "display_filter": "frame.number == 13171", "timestamp_epoch": "1580346261.466624000" }, { "udp_stream": 109, "frame_number": 13185, "display_filter": "frame.number == 13185", "timestamp_epoch": "1580346261.489516000" }, { "tcp_stream": 138, "frame_number": 13191, "display_filter": "frame.number == 13191", "timestamp_epoch": "1580346261.504672000" }, { "tcp_stream": 138, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1580346261.557116000" }, { "tcp_stream": 145, "frame_number": 13353, "display_filter": "frame.number == 13353", "timestamp_epoch": "1580346261.578833000" }, { "tcp_stream": 145, "frame_number": 13474, "display_filter": "frame.number == 13474", "timestamp_epoch": "1580346262.061304000" } ], "is_private": null, "observable_id": "observable-d46adf105e38738bf6119668", "last_seen_epoch": "1580346262.061304000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.466624000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "nexusrules.officeapps.live.com", "evidence": [ { "udp_stream": 47, "frame_number": 7723, "display_filter": "frame.number == 7723", "timestamp_epoch": "1580345984.277983000" }, { "udp_stream": 47, "frame_number": 7724, "display_filter": "frame.number == 7724", "timestamp_epoch": "1580345984.336546000" }, { "tcp_stream": 71, "frame_number": 7728, "display_filter": "frame.number == 7728", "timestamp_epoch": "1580345984.463481000" } ], "is_private": null, "observable_id": "observable-4345a35c4c943043d234c876", "last_seen_epoch": "1580345984.463481000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345984.277983000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "novvslyn.localdomain", "evidence": [ { "udp_stream": 63, "frame_number": 7995, "display_filter": "frame.number == 7995", "timestamp_epoch": "1580346140.079440000" }, { "udp_stream": 63, "frame_number": 7999, "display_filter": "frame.number == 7999", "timestamp_epoch": "1580346140.101371000" } ], "is_private": null, "observable_id": "observable-67b1f4b386858ac9c4d451d3", "last_seen_epoch": "1580346140.101371000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346140.079440000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "novvslyn.sol-lightnet.com", "evidence": [ { "udp_stream": 60, "frame_number": 7990, "display_filter": "frame.number == 7990", "timestamp_epoch": "1580346140.078545000" }, { "udp_stream": 60, "frame_number": 7992, "display_filter": "frame.number == 7992", "timestamp_epoch": "1580346140.078961000" } ], "is_private": null, "observable_id": "observable-15e828ff0ea60cb787d553b1", "last_seen_epoch": "1580346140.078961000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346140.078545000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ogs.google.com", "evidence": [ { "udp_stream": 82, "frame_number": 8791, "display_filter": "frame.number == 8791", "timestamp_epoch": "1580346163.992029000" }, { "udp_stream": 82, "frame_number": 8847, "display_filter": "frame.number == 8847", "timestamp_epoch": "1580346164.019463000" }, { "tcp_stream": 99, "frame_number": 8853, "display_filter": "frame.number == 8853", "timestamp_epoch": "1580346164.035709000" } ], "is_private": null, "observable_id": "observable-4df66ca748839ffe25780510", "last_seen_epoch": "1580346164.035709000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.992029000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "p.typekit.net", "evidence": [ { "udp_stream": 100, "frame_number": 12029, "display_filter": "frame.number == 12029", "timestamp_epoch": "1580346177.160264000" }, { "udp_stream": 100, "frame_number": 12034, "display_filter": "frame.number == 12034", "timestamp_epoch": "1580346177.179770000" }, { "tcp_stream": 126, "frame_number": 12038, "display_filter": "frame.number == 12038", "timestamp_epoch": "1580346177.193732000" } ], "is_private": null, "observable_id": "observable-30541647766e053dfc18d334", "last_seen_epoch": "1580346177.193732000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346177.160264000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "pagead46.l.doubleclick.net", "evidence": [ { "udp_stream": 83, "frame_number": 8899, "display_filter": "frame.number == 8899", "timestamp_epoch": "1580346164.189103000" }, { "udp_stream": 84, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1580346164.306160000" } ], "is_private": null, "observable_id": "observable-0edfeca0148343e72aa3f587", "last_seen_epoch": "1580346164.306160000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.189103000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "play.google.com", "evidence": [ { "udp_stream": 85, "frame_number": 8969, "display_filter": "frame.number == 8969", "timestamp_epoch": "1580346164.921973000" }, { "udp_stream": 85, "frame_number": 8970, "display_filter": "frame.number == 8970", "timestamp_epoch": "1580346164.942489000" }, { "tcp_stream": 102, "frame_number": 8974, "display_filter": "frame.number == 8974", "timestamp_epoch": "1580346164.956726000" } ], "is_private": null, "observable_id": "observable-0686ca97d56768d2ff79df19", "last_seen_epoch": "1580346164.956726000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.921973000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "plus.l.google.com", "evidence": [ { "udp_stream": 81, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1580346163.926174000" } ], "is_private": null, "observable_id": "observable-8a68573d0c7b01baeea4ec07", "last_seen_epoch": "1580346163.926174000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.926174000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.nexusrules.live.com.akadns.net", "evidence": [ { "udp_stream": 47, "frame_number": 7724, "display_filter": "frame.number == 7724", "timestamp_epoch": "1580345984.336546000" } ], "is_private": null, "observable_id": "observable-15ed8f6d4512f367e967c1b9", "last_seen_epoch": "1580345984.336546000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345984.336546000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.squarespace.map.fastly.net", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "is_private": null, "observable_id": "observable-cab2b43ca9f0df5e5cb5082f", "last_seen_epoch": "1580346260.300132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.008872000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pti.store.microsoft.com", "evidence": [ { "udp_stream": 46, "frame_number": 7671, "display_filter": "frame.number == 7671", "timestamp_epoch": "1580345870.794640000" }, { "udp_stream": 46, "frame_number": 7672, "display_filter": "frame.number == 7672", "timestamp_epoch": "1580345870.814698000" }, { "tcp_stream": 69, "frame_number": 7677, "display_filter": "frame.number == 7677", "timestamp_epoch": "1580345870.832298000" } ], "is_private": null, "observable_id": "observable-1147e13b1931b6c70c76844d", "last_seen_epoch": "1580345870.832298000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345870.794640000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "s-0001.s-msedge.net", "evidence": [ { "udp_stream": 58, "frame_number": 7948, "display_filter": "frame.number == 7948", "timestamp_epoch": "1580346136.088326000" } ], "is_private": null, "observable_id": "observable-d3534d05ba9c690dbdb1793c", "last_seen_epoch": "1580346136.088326000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346136.088326000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "self.events.data.microsoft.com", "evidence": [ { "udp_stream": 26, "frame_number": 729, "display_filter": "frame.number == 729", "timestamp_epoch": "1580345703.914322000" }, { "udp_stream": 26, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1580345703.932605000" }, { "udp_stream": 40, "frame_number": 1327, "display_filter": "frame.number == 1327", "timestamp_epoch": "1580345761.053095000" }, { "udp_stream": 40, "frame_number": 1356, "display_filter": "frame.number == 1356", "timestamp_epoch": "1580345761.097005000" }, { "tcp_stream": 38, "frame_number": 800, "display_filter": "frame.number == 800", "timestamp_epoch": "1580345704.119816000" }, { "tcp_stream": 61, "frame_number": 1398, "display_filter": "frame.number == 1398", "timestamp_epoch": "1580345761.150625000" }, { "tcp_stream": 77, "frame_number": 7830, "display_filter": "frame.number == 7830", "timestamp_epoch": "1580346023.998910000" }, { "tcp_stream": 78, "frame_number": 7869, "display_filter": "frame.number == 7869", "timestamp_epoch": "1580346113.588301000" }, { "tcp_stream": 79, "frame_number": 7873, "display_filter": "frame.number == 7873", "timestamp_epoch": "1580346113.627817000" } ], "is_private": null, "observable_id": "observable-05eb2400b156211fca744171", "last_seen_epoch": "1580346113.627817000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345703.914322000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "self.events.data.onecollector.akadns.net", "evidence": [ { "udp_stream": 26, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1580345703.932605000" }, { "udp_stream": 40, "frame_number": 1356, "display_filter": "frame.number == 1356", "timestamp_epoch": "1580345761.097005000" } ], "is_private": null, "observable_id": "observable-ddbf4f92702e25954b47f672", "last_seen_epoch": "1580345761.097005000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345703.932605000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "sol-lightnet-dc.sol-lightnet.com", "evidence": [ { "udp_stream": 13, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1580345693.606109000" }, { "udp_stream": 13, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1580345693.606441000" } ], "is_private": null, "observable_id": "observable-3615d8b38021f237e0e52de2", "last_seen_epoch": "1580345693.606441000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345693.606109000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "sol-lightnet.com", "evidence": [ { "udp_stream": 15, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1580345694.868990000" }, { "udp_stream": 15, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1580345694.870229000" }, { "udp_stream": 27, "frame_number": 763, "display_filter": "frame.number == 763", "timestamp_epoch": "1580345703.983963000" }, { "udp_stream": 27, "frame_number": 764, "display_filter": "frame.number == 764", "timestamp_epoch": "1580345703.984249000" } ], "is_private": null, "observable_id": "observable-a6ca1f1d93f10b9b782ced58", "last_seen_epoch": "1580345703.984249000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345694.868990000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "squarespace.map.fastly.net", "evidence": [ { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" } ], "is_private": null, "observable_id": "observable-79b337409ebb033536cad04d", "last_seen_epoch": "1580346176.092439000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.092439000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "srjnzgvklqxna.localdomain", "evidence": [ { "udp_stream": 64, "frame_number": 7997, "display_filter": "frame.number == 7997", "timestamp_epoch": "1580346140.079778000" }, { "udp_stream": 64, "frame_number": 8000, "display_filter": "frame.number == 8000", "timestamp_epoch": "1580346140.101541000" } ], "is_private": null, "observable_id": "observable-d552d0c6b774e72f7a60e8a2", "last_seen_epoch": "1580346140.101541000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346140.079778000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "srjnzgvklqxna.sol-lightnet.com", "evidence": [ { "udp_stream": 61, "frame_number": 7991, "display_filter": "frame.number == 7991", "timestamp_epoch": "1580346140.078803000" }, { "udp_stream": 61, "frame_number": 7993, "display_filter": "frame.number == 7993", "timestamp_epoch": "1580346140.079215000" } ], "is_private": null, "observable_id": "observable-ae4554bf83eb0105c9cc7f3d", "last_seen_epoch": "1580346140.079215000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346140.078803000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ssl.gstatic.com", "evidence": [ { "udp_stream": 77, "frame_number": 8343, "display_filter": "frame.number == 8343", "timestamp_epoch": "1580346163.271673000" }, { "udp_stream": 77, "frame_number": 8346, "display_filter": "frame.number == 8346", "timestamp_epoch": "1580346163.292957000" }, { "tcp_stream": 93, "frame_number": 8353, "display_filter": "frame.number == 8353", "timestamp_epoch": "1580346163.306491000" } ], "is_private": null, "observable_id": "observable-42f0807d3163d31afc14e8a0", "last_seen_epoch": "1580346163.306491000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.271673000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "star-mini.c10r.facebook.com", "evidence": [ { "udp_stream": 98, "frame_number": 11079, "display_filter": "frame.number == 11079", "timestamp_epoch": "1580346176.916963000" }, { "udp_stream": 107, "frame_number": 12974, "display_filter": "frame.number == 12974", "timestamp_epoch": "1580346261.179938000" } ], "is_private": null, "observable_id": "observable-290b1f7330903804b038cb81", "last_seen_epoch": "1580346261.179938000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.916963000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "static1.squarespace.com", "evidence": [ { "udp_stream": 94, "frame_number": 9966, "display_filter": "frame.number == 9966", "timestamp_epoch": "1580346175.979322000" }, { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 103, "frame_number": 12892, "display_filter": "frame.number == 12892", "timestamp_epoch": "1580346260.272017000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" }, { "tcp_stream": 114, "frame_number": 10010, "display_filter": "frame.number == 10010", "timestamp_epoch": "1580346176.020125000" }, { "tcp_stream": 116, "frame_number": 10012, "display_filter": "frame.number == 10012", "timestamp_epoch": "1580346176.020274000" }, { "tcp_stream": 115, "frame_number": 10008, "display_filter": "frame.number == 10008", "timestamp_epoch": "1580346176.019853000" } ], "is_private": null, "observable_id": "observable-e7c194496ef70e806e6d2cc0", "last_seen_epoch": "1580346260.300132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.979322000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "t-ring.msedge.net", "evidence": [ { "udp_stream": 72, "frame_number": 8114, "display_filter": "frame.number == 8114", "timestamp_epoch": "1580346153.147280000" }, { "udp_stream": 72, "frame_number": 8115, "display_filter": "frame.number == 8115", "timestamp_epoch": "1580346153.165117000" }, { "tcp_stream": 86, "frame_number": 8119, "display_filter": "frame.number == 8119", "timestamp_epoch": "1580346153.179668000" } ], "is_private": null, "observable_id": "observable-b0fa697b7b212fc483ec6564", "last_seen_epoch": "1580346153.179668000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346153.147280000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "twereptale.com", "evidence": [ { "udp_stream": 37, "frame_number": 1246, "display_filter": "frame.number == 1246", "timestamp_epoch": "1580345758.460647000" }, { "udp_stream": 37, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1580345758.668788000" }, { "udp_stream": 39, "frame_number": 1308, "display_filter": "frame.number == 1308", "timestamp_epoch": "1580345760.481660000" }, { "udp_stream": 39, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1580345760.482013000" }, { "tcp_stream": 57, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1580345758.838022000" }, { "tcp_stream": 59, "frame_number": 1315, "display_filter": "frame.number == 1315", "timestamp_epoch": "1580345760.647757000" }, { "tcp_stream": 63, "frame_number": 3586, "display_filter": "frame.number == 3586", "timestamp_epoch": "1580345765.163080000" }, { "tcp_stream": 70, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1580345885.104183000" }, { "tcp_stream": 76, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1580346005.497228000" }, { "tcp_stream": 80, "frame_number": 7916, "display_filter": "frame.number == 7916", "timestamp_epoch": "1580346125.870845000" }, { "tcp_stream": 127, "frame_number": 12855, "display_filter": "frame.number == 12855", "timestamp_epoch": "1580346246.270378000" } ], "is_private": null, "observable_id": "observable-eeefbb5ba49b1ed721120871", "last_seen_epoch": "1580346246.270378000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.460647000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "use.typekit.net", "evidence": [ { "udp_stream": 92, "frame_number": 9964, "display_filter": "frame.number == 9964", "timestamp_epoch": "1580346175.976792000" }, { "udp_stream": 92, "frame_number": 9967, "display_filter": "frame.number == 9967", "timestamp_epoch": "1580346175.990586000" }, { "udp_stream": 102, "frame_number": 12891, "display_filter": "frame.number == 12891", "timestamp_epoch": "1580346260.269585000" }, { "udp_stream": 102, "frame_number": 12897, "display_filter": "frame.number == 12897", "timestamp_epoch": "1580346260.282579000" }, { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" }, { "tcp_stream": 119, "frame_number": 11116, "display_filter": "frame.number == 11116", "timestamp_epoch": "1580346176.933425000" }, { "tcp_stream": 122, "frame_number": 11119, "display_filter": "frame.number == 11119", "timestamp_epoch": "1580346176.933874000" }, { "tcp_stream": 123, "frame_number": 11125, "display_filter": "frame.number == 11125", "timestamp_epoch": "1580346176.934528000" }, { "tcp_stream": 124, "frame_number": 11131, "display_filter": "frame.number == 11131", "timestamp_epoch": "1580346176.936624000" }, { "tcp_stream": 125, "frame_number": 11135, "display_filter": "frame.number == 11135", "timestamp_epoch": "1580346176.937865000" }, { "tcp_stream": 130, "frame_number": 12916, "display_filter": "frame.number == 12916", "timestamp_epoch": "1580346260.316460000" } ], "is_private": null, "observable_id": "observable-3f737f67991064896752f5e2", "last_seen_epoch": "1580346260.316460000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.976792000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 30, "frame_number": 967, "display_filter": "frame.number == 967", "timestamp_epoch": "1580345706.619777000" }, { "udp_stream": 30, "frame_number": 968, "display_filter": "frame.number == 968", "timestamp_epoch": "1580345706.619934000" }, { "udp_stream": 45, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1580345766.627729000" }, { "udp_stream": 45, "frame_number": 4578, "display_filter": "frame.number == 4578", "timestamp_epoch": "1580345766.628153000" }, { "udp_stream": 51, "frame_number": 7922, "display_filter": "frame.number == 7922", "timestamp_epoch": "1580346133.532618000" }, { "udp_stream": 51, "frame_number": 7923, "display_filter": "frame.number == 7923", "timestamp_epoch": "1580346133.532959000" }, { "udp_stream": 56, "frame_number": 7938, "display_filter": "frame.number == 7938", "timestamp_epoch": "1580346135.068977000" }, { "udp_stream": 56, "frame_number": 7939, "display_filter": "frame.number == 7939", "timestamp_epoch": "1580346135.069615000" }, { "udp_stream": 89, "frame_number": 9922, "display_filter": "frame.number == 9922", "timestamp_epoch": "1580346175.657584000" }, { "udp_stream": 89, "frame_number": 9923, "display_filter": "frame.number == 9923", "timestamp_epoch": "1580346175.657775000" } ], "is_private": null, "observable_id": "observable-e5250f6ce9432fbc15cd3488", "last_seen_epoch": "1580346175.657775000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345706.619777000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.sol-lightnet.com", "evidence": [ { "udp_stream": 29, "frame_number": 965, "display_filter": "frame.number == 965", "timestamp_epoch": "1580345706.619144000" }, { "udp_stream": 29, "frame_number": 966, "display_filter": "frame.number == 966", "timestamp_epoch": "1580345706.619407000" }, { "udp_stream": 44, "frame_number": 4573, "display_filter": "frame.number == 4573", "timestamp_epoch": "1580345766.626268000" }, { "udp_stream": 44, "frame_number": 4575, "display_filter": "frame.number == 4575", "timestamp_epoch": "1580345766.626816000" }, { "udp_stream": 50, "frame_number": 7920, "display_filter": "frame.number == 7920", "timestamp_epoch": "1580346133.530307000" }, { "udp_stream": 50, "frame_number": 7921, "display_filter": "frame.number == 7921", "timestamp_epoch": "1580346133.530794000" }, { "udp_stream": 55, "frame_number": 7936, "display_filter": "frame.number == 7936", "timestamp_epoch": "1580346135.067261000" }, { "udp_stream": 55, "frame_number": 7937, "display_filter": "frame.number == 7937", "timestamp_epoch": "1580346135.067724000" }, { "udp_stream": 88, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1580346175.656865000" }, { "udp_stream": 88, "frame_number": 9921, "display_filter": "frame.number == 9921", "timestamp_epoch": "1580346175.657159000" } ], "is_private": null, "observable_id": "observable-41aff77a1cee2ecb75249680", "last_seen_epoch": "1580346175.657159000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345706.619144000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 31, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1580345708.560332000" }, { "udp_stream": 31, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1580345708.579100000" }, { "tcp_stream": 48, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1580345708.685523000" }, { "tcp_stream": 84, "frame_number": 8061, "display_filter": "frame.number == 8061", "timestamp_epoch": "1580346149.625887000" } ], "is_private": null, "observable_id": "observable-cf05bedb57269b04cddc983c", "last_seen_epoch": "1580346149.625887000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345708.560332000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.facebook.com", "evidence": [ { "udp_stream": 98, "frame_number": 11076, "display_filter": "frame.number == 11076", "timestamp_epoch": "1580346176.900868000" }, { "udp_stream": 98, "frame_number": 11079, "display_filter": "frame.number == 11079", "timestamp_epoch": "1580346176.916963000" }, { "udp_stream": 107, "frame_number": 12966, "display_filter": "frame.number == 12966", "timestamp_epoch": "1580346261.150453000" }, { "udp_stream": 107, "frame_number": 12974, "display_filter": "frame.number == 12974", "timestamp_epoch": "1580346261.179938000" } ], "is_private": null, "observable_id": "observable-bedada1f096215d36c4fc9c7", "last_seen_epoch": "1580346261.179938000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.900868000" }, { "type": "domain", "roles": [ "dns-query", "http-host", "tls-sni" ], "value": "www.google.com", "evidence": [ { "udp_stream": 76, "frame_number": 8225, "display_filter": "frame.number == 8225", "timestamp_epoch": "1580346162.774103000" }, { "udp_stream": 76, "frame_number": 8226, "display_filter": "frame.number == 8226", "timestamp_epoch": "1580346162.796395000" }, { "udp_stream": 112, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1580346262.060835000" }, { "udp_stream": 112, "frame_number": 13479, "display_filter": "frame.number == 13479", "timestamp_epoch": "1580346262.083115000" }, { "tcp_stream": 91, "frame_number": 8231, "display_filter": "frame.number == 8231", "timestamp_epoch": "1580346162.810738000" }, { "tcp_stream": 91, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1580346175.652447000" }, { "tcp_stream": 92, "frame_number": 8237, "display_filter": "frame.number == 8237", "timestamp_epoch": "1580346162.859161000" } ], "is_private": null, "observable_id": "observable-09c76cfa0c6060ddff741179", "last_seen_epoch": "1580346262.083115000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.774103000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.gstatic.com", "evidence": [ { "udp_stream": 79, "frame_number": 8393, "display_filter": "frame.number == 8393", "timestamp_epoch": "1580346163.385566000" }, { "udp_stream": 79, "frame_number": 8410, "display_filter": "frame.number == 8410", "timestamp_epoch": "1580346163.408663000" }, { "tcp_stream": 96, "frame_number": 8433, "display_filter": "frame.number == 8433", "timestamp_epoch": "1580346163.421483000" } ], "is_private": null, "observable_id": "observable-952474312a7bed1e1bf8a1dd", "last_seen_epoch": "1580346163.421483000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.385566000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "www.instagram.com", "evidence": [ { "udp_stream": 99, "frame_number": 11140, "display_filter": "frame.number == 11140", "timestamp_epoch": "1580346176.940784000" }, { "udp_stream": 99, "frame_number": 11217, "display_filter": "frame.number == 11217", "timestamp_epoch": "1580346176.960653000" }, { "udp_stream": 106, "frame_number": 12965, "display_filter": "frame.number == 12965", "timestamp_epoch": "1580346261.149966000" }, { "udp_stream": 106, "frame_number": 12975, "display_filter": "frame.number == 12975", "timestamp_epoch": "1580346261.180031000" } ], "is_private": null, "observable_id": "observable-1ca8d09224f87c4c381b8458", "last_seen_epoch": "1580346261.180031000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.940784000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "www.tippingpointhampstead.com", "evidence": [ { "udp_stream": 91, "frame_number": 9929, "display_filter": "frame.number == 9929", "timestamp_epoch": "1580346175.766263000" }, { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" }, { "tcp_stream": 106, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1580346175.871552000" }, { "tcp_stream": 106, "frame_number": 11070, "display_filter": "frame.number == 11070", "timestamp_epoch": "1580346176.888399000" }, { "tcp_stream": 107, "frame_number": 11073, "display_filter": "frame.number == 11073", "timestamp_epoch": "1580346176.893673000" }, { "tcp_stream": 128, "frame_number": 12904, "display_filter": "frame.number == 12904", "timestamp_epoch": "1580346260.307088000" }, { "tcp_stream": 129, "frame_number": 12912, "display_filter": "frame.number == 12912", "timestamp_epoch": "1580346260.315953000" }, { "tcp_stream": 128, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1580346260.376231000" }, { "tcp_stream": 128, "frame_number": 12957, "display_filter": "frame.number == 12957", "timestamp_epoch": "1580346261.126327000" }, { "tcp_stream": 129, "frame_number": 12960, "display_filter": "frame.number == 12960", "timestamp_epoch": "1580346261.127758000" }, { "tcp_stream": 132, "frame_number": 12962, "display_filter": "frame.number == 12962", "timestamp_epoch": "1580346261.128864000" }, { "tcp_stream": 133, "frame_number": 12979, "display_filter": "frame.number == 12979", "timestamp_epoch": "1580346261.183798000" } ], "is_private": null, "observable_id": "observable-7f6ec386949af78b236e810f", "last_seen_epoch": "1580346261.183798000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.766263000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "www3.l.google.com", "evidence": [ { "udp_stream": 82, "frame_number": 8847, "display_filter": "frame.number == 8847", "timestamp_epoch": "1580346164.019463000" } ], "is_private": null, "observable_id": "observable-88909cb39ee56156b0d1544a", "last_seen_epoch": "1580346164.019463000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.019463000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "xolightfinance.com", "evidence": [ { "udp_stream": 38, "frame_number": 1255, "display_filter": "frame.number == 1255", "timestamp_epoch": "1580345759.048081000" }, { "udp_stream": 38, "frame_number": 1256, "display_filter": "frame.number == 1256", "timestamp_epoch": "1580345759.142249000" }, { "tcp_stream": 58, "frame_number": 1260, "display_filter": "frame.number == 1260", "timestamp_epoch": "1580345759.390149000" }, { "tcp_stream": 58, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1580345764.042624000" } ], "is_private": null, "observable_id": "observable-ceeee973527d2d7733fd9fd4", "last_seen_epoch": "1580345764.042624000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345759.048081000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "z-p42-instagram.c10r.facebook.com", "evidence": [ { "udp_stream": 99, "frame_number": 11217, "display_filter": "frame.number == 11217", "timestamp_epoch": "1580346176.960653000" }, { "udp_stream": 106, "frame_number": 12975, "display_filter": "frame.number == 12975", "timestamp_epoch": "1580346261.180031000" } ], "is_private": null, "observable_id": "observable-d7d1bf41978ca2a6862503cf", "last_seen_epoch": "1580346261.180031000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.960653000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "zpckjikzgjvck.localdomain", "evidence": [ { "udp_stream": 65, "frame_number": 7998, "display_filter": "frame.number == 7998", "timestamp_epoch": "1580346140.080227000" }, { "udp_stream": 65, "frame_number": 8001, "display_filter": "frame.number == 8001", "timestamp_epoch": "1580346140.101886000" } ], "is_private": null, "observable_id": "observable-fbec66ed5919fe95e199d558", "last_seen_epoch": "1580346140.101886000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346140.080227000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "zpckjikzgjvck.sol-lightnet.com", "evidence": [ { "udp_stream": 62, "frame_number": 7994, "display_filter": "frame.number == 7994", "timestamp_epoch": "1580346140.079379000" }, { "udp_stream": 62, "frame_number": 7996, "display_filter": "frame.number == 7996", "timestamp_epoch": "1580346140.079639000" } ], "is_private": null, "observable_id": "observable-ac0c3b9e5afb73d08023cb61", "last_seen_epoch": "1580346140.079639000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346140.079379000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.20.30.1", "evidence": [], "is_private": true, "observable_id": "observable-8ee0d03ad119d74baa94c227", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.20.30.2", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1580345692.506101000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1580345692.612130000" }, { "udp_stream": 7, "frame_number": 158, "display_filter": "frame.number == 158", "timestamp_epoch": "1580345692.876703000" }, { "udp_stream": 9, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1580345693.006461000" }, { "udp_stream": 11, "frame_number": 186, "display_filter": "frame.number == 186", "timestamp_epoch": "1580345693.209304000" }, { "udp_stream": 13, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1580345693.606441000" }, { "udp_stream": 14, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1580345694.867451000" }, { "udp_stream": 18, "frame_number": 513, "display_filter": "frame.number == 513", "timestamp_epoch": "1580345695.800856000" }, { "udp_stream": 27, "frame_number": 764, "display_filter": "frame.number == 764", "timestamp_epoch": "1580345703.984249000" }, { "udp_stream": 33, "frame_number": 1146, "display_filter": "frame.number == 1146", "timestamp_epoch": "1580345753.345199000" }, { "udp_stream": 42, "frame_number": 3474, "display_filter": "frame.number == 3474", "timestamp_epoch": "1580345764.891800000" }, { "udp_stream": 48, "frame_number": 7746, "display_filter": "frame.number == 7746", "timestamp_epoch": "1580345993.866483000" } ], "is_private": true, "observable_id": "observable-38dfa6ac17a673f28a8c6b36", "last_seen_epoch": "1580345993.866483000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345692.506101000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "10.20.30.227", "evidence": [ { "udp_stream": 15, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1580345694.868990000" }, { "udp_stream": 15, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1580345694.870229000" } ], "is_private": true, "observable_id": "observable-270ca3c3d1d6ae000bdb4731", "last_seen_epoch": "1580345694.870229000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345694.868990000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "10.20.30.255", "evidence": [], "is_private": true, "observable_id": "observable-049b18adb98c0ac048b27ea6", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.81.85.107", "evidence": [ { "udp_stream": 92, "frame_number": 9967, "display_filter": "frame.number == 9967", "timestamp_epoch": "1580346175.990586000" }, { "udp_stream": 100, "frame_number": 12034, "display_filter": "frame.number == 12034", "timestamp_epoch": "1580346177.179770000" }, { "udp_stream": 102, "frame_number": 12897, "display_filter": "frame.number == 12897", "timestamp_epoch": "1580346260.282579000" } ], "is_private": false, "observable_id": "observable-ecd299567ebb59f58115c259", "last_seen_epoch": "1580346260.282579000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.990586000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.97.213.249", "evidence": [ { "udp_stream": 93, "frame_number": 9969, "display_filter": "frame.number == 9969", "timestamp_epoch": "1580346175.996891000" }, { "udp_stream": 104, "frame_number": 12918, "display_filter": "frame.number == 12918", "timestamp_epoch": "1580346260.328782000" } ], "is_private": false, "observable_id": "observable-744e3486e2420aee898b86df", "last_seen_epoch": "1580346260.328782000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.996891000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 31, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1580345708.579100000" } ], "is_private": false, "observable_id": "observable-0aa1b9be090cd409abad3b74", "last_seen_epoch": "1580345708.579100000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345708.579100000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.246.10", "evidence": [ { "udp_stream": 46, "frame_number": 7672, "display_filter": "frame.number == 7672", "timestamp_epoch": "1580345870.814698000" } ], "is_private": false, "observable_id": "observable-7e1909485ccc20c1f7193b9f", "last_seen_epoch": "1580345870.814698000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345870.814698000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.246.254", "evidence": [ { "udp_stream": 72, "frame_number": 8115, "display_filter": "frame.number == 8115", "timestamp_epoch": "1580346153.165117000" } ], "is_private": false, "observable_id": "observable-cd8c55c8f5b3884012339f99", "last_seen_epoch": "1580346153.165117000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346153.165117000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.3.128", "evidence": [ { "udp_stream": 58, "frame_number": 7948, "display_filter": "frame.number == 7948", "timestamp_epoch": "1580346136.088326000" } ], "is_private": false, "observable_id": "observable-ff7e8ddfe83bd6ccb4942262", "last_seen_epoch": "1580346136.088326000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346136.088326000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.42.254", "evidence": [ { "udp_stream": 73, "frame_number": 8145, "display_filter": "frame.number == 8145", "timestamp_epoch": "1580346153.280341000" } ], "is_private": false, "observable_id": "observable-81ed5555e35fd2147bb4410e", "last_seen_epoch": "1580346153.280341000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346153.280341000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.6.158", "evidence": [ { "udp_stream": 80, "frame_number": 8440, "display_filter": "frame.number == 8440", "timestamp_epoch": "1580346163.429483000" } ], "is_private": false, "observable_id": "observable-06d42fa16cfa5e57be4e4d50", "last_seen_epoch": "1580346163.429483000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.429483000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "148.66.137.40", "evidence": [ { "udp_stream": 38, "frame_number": 1256, "display_filter": "frame.number == 1256", "timestamp_epoch": "1580345759.142249000" } ], "is_private": false, "observable_id": "observable-a3f1204fa60fc5b3292520fb", "last_seen_epoch": "1580345759.142249000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345759.142249000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "151.101.0.238", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "is_private": false, "observable_id": "observable-3d00114ac0d006e86ba38612", "last_seen_epoch": "1580346260.300132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.008872000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.128.238", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "is_private": false, "observable_id": "observable-8b92ad5746f9db98f59270e7", "last_seen_epoch": "1580346260.300132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.008872000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.192.238", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "is_private": false, "observable_id": "observable-9910cff152f5c5e4006b7568", "last_seen_epoch": "1580346260.300132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.008872000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "151.101.64.238", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "is_private": false, "observable_id": "observable-38ec2b7b8299e374448f4a8f", "last_seen_epoch": "1580346260.300132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.008872000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.1.238", "evidence": [ { "udp_stream": 81, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1580346163.926174000" }, { "udp_stream": 82, "frame_number": 8847, "display_filter": "frame.number == 8847", "timestamp_epoch": "1580346164.019463000" } ], "is_private": false, "observable_id": "observable-19204220adaea5f662f62fce", "last_seen_epoch": "1580346164.019463000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.926174000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.12.46", "evidence": [ { "udp_stream": 111, "frame_number": 13194, "display_filter": "frame.number == 13194", "timestamp_epoch": "1580346261.515711000" } ], "is_private": false, "observable_id": "observable-43a307028a1b1ca8c6f90509", "last_seen_epoch": "1580346261.515711000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.515711000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.14.163", "evidence": [ { "udp_stream": 78, "frame_number": 8367, "display_filter": "frame.number == 8367", "timestamp_epoch": "1580346163.359843000" }, { "udp_stream": 105, "frame_number": 12919, "display_filter": "frame.number == 12919", "timestamp_epoch": "1580346260.328844000" } ], "is_private": false, "observable_id": "observable-5b49c466655b1c3b61bc7cc6", "last_seen_epoch": "1580346260.328844000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.359843000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.14.170", "evidence": [ { "udp_stream": 95, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1580346176.008821000" } ], "is_private": false, "observable_id": "observable-0f9f78bb64f0ed70b6674dd9", "last_seen_epoch": "1580346176.008821000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.008821000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.2.227", "evidence": [ { "udp_stream": 109, "frame_number": 13185, "display_filter": "frame.number == 13185", "timestamp_epoch": "1580346261.489516000" } ], "is_private": false, "observable_id": "observable-020af2550833ac697a16d4d0", "last_seen_epoch": "1580346261.489516000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.489516000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.2.238", "evidence": [ { "udp_stream": 110, "frame_number": 13193, "display_filter": "frame.number == 13193", "timestamp_epoch": "1580346261.515653000" } ], "is_private": false, "observable_id": "observable-b7d82a3e75e44dbc7bde38f8", "last_seen_epoch": "1580346261.515653000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.515653000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.9.1", "evidence": [ { "udp_stream": 86, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1580346173.078164000" }, { "udp_stream": 87, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1580346174.305768000" } ], "is_private": false, "observable_id": "observable-31e041284026c53eb24cc367", "last_seen_epoch": "1580346174.305768000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346173.078164000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.9.170", "evidence": [ { "udp_stream": 108, "frame_number": 12984, "display_filter": "frame.number == 12984", "timestamp_epoch": "1580346261.193361000" } ], "is_private": false, "observable_id": "observable-d85ee97d407dd5e5a6294245", "last_seen_epoch": "1580346261.193361000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.193361000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.217.9.3", "evidence": [ { "udp_stream": 79, "frame_number": 8410, "display_filter": "frame.number == 8410", "timestamp_epoch": "1580346163.408663000" } ], "is_private": false, "observable_id": "observable-72644bc6f0fc8e638d1d05a6", "last_seen_epoch": "1580346163.408663000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.408663000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "174.129.223.190", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-796f923911ec361a6c16fa82", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "184.73.165.106", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-3486dc4a7d3359fdd16df1a2", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "184.73.201.169", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-f7cf4defbf67487e22933aa3", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "198.185.159.144", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "is_private": false, "observable_id": "observable-d8e29d357b86421daa5bbc90", "last_seen_epoch": "1580346175.824400000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.824400000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.185.159.145", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "is_private": false, "observable_id": "observable-27b241c4684df799ab52da1f", "last_seen_epoch": "1580346175.824400000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.824400000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.49.23.144", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "is_private": false, "observable_id": "observable-5709f9db91a39203df4fd615", "last_seen_epoch": "1580346175.824400000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.824400000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "198.49.23.145", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "is_private": false, "observable_id": "observable-d4b9f0b687cd7fb2fb0be243", "last_seen_epoch": "1580346175.824400000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.824400000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 31, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1580345708.579100000" } ], "is_private": false, "observable_id": "observable-ab480ac094bdf532aca0cd40", "last_seen_epoch": "1580345708.579100000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345708.579100000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.222", "evidence": [ { "udp_stream": 71, "frame_number": 8087, "display_filter": "frame.number == 8087", "timestamp_epoch": "1580346150.991621000" } ], "is_private": false, "observable_id": "observable-59136881d4b4f0510e72b070", "last_seen_epoch": "1580346150.991621000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346150.991621000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.254", "evidence": [ { "udp_stream": 74, "frame_number": 8175, "display_filter": "frame.number == 8175", "timestamp_epoch": "1580346153.383388000" } ], "is_private": false, "observable_id": "observable-ced0feb55294244200c5aa86", "last_seen_epoch": "1580346153.383388000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346153.383388000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.193.130", "evidence": [ { "udp_stream": 83, "frame_number": 8899, "display_filter": "frame.number == 8899", "timestamp_epoch": "1580346164.189103000" }, { "udp_stream": 84, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1580346164.306160000" } ], "is_private": false, "observable_id": "observable-15e2ffee8b3ffb9515de1dd4", "last_seen_epoch": "1580346164.306160000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.189103000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.193.132", "evidence": [ { "udp_stream": 76, "frame_number": 8226, "display_filter": "frame.number == 8226", "timestamp_epoch": "1580346162.796395000" }, { "udp_stream": 112, "frame_number": 13479, "display_filter": "frame.number == 13479", "timestamp_epoch": "1580346262.083115000" } ], "is_private": false, "observable_id": "observable-2ad684541d152704ed0b3c81", "last_seen_epoch": "1580346262.083115000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.796395000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.131", "evidence": [ { "udp_stream": 77, "frame_number": 8346, "display_filter": "frame.number == 8346", "timestamp_epoch": "1580346163.292957000" } ], "is_private": false, "observable_id": "observable-d41375769c0cd41ba75809d0", "last_seen_epoch": "1580346163.292957000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346163.292957000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.46", "evidence": [ { "udp_stream": 75, "frame_number": 8215, "display_filter": "frame.number == 8215", "timestamp_epoch": "1580346162.725232000" } ], "is_private": false, "observable_id": "observable-e0d18b6ffe9b78cf542a825b", "last_seen_epoch": "1580346162.725232000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.725232000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "216.58.194.78", "evidence": [ { "udp_stream": 85, "frame_number": 8970, "display_filter": "frame.number == 8970", "timestamp_epoch": "1580346164.942489000" }, { "udp_stream": 97, "frame_number": 11088, "display_filter": "frame.number == 11088", "timestamp_epoch": "1580346176.923260000" } ], "is_private": false, "observable_id": "observable-afc61aaf3dc62d73f1bfb875", "last_seen_epoch": "1580346176.923260000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346164.942489000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-a1f036847f83c05c5fb9e90b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.251", "evidence": [], "is_private": false, "observable_id": "observable-127eb3013b3be4349cb7900f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-92b9868137665d752a2041e2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.21.50.37", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-1d6d528468e8bb2eb0041901", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.21.59.179", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-2724719282a4422bfd32dd8a", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.51.186.146", "evidence": [ { "udp_stream": 16, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1580345695.260860000" } ], "is_private": false, "observable_id": "observable-15d1be10a78425c8951f31a7", "last_seen_epoch": "1580345695.260860000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.260860000" }, { "type": "ipv4", "roles": [ "http-host", "network-endpoint" ], "value": "239.255.255.250", "evidence": [ { "frame_number": 7927, "display_filter": "frame.number == 7927", "timestamp_epoch": "1580346133.604864000" }, { "frame_number": 7934, "display_filter": "frame.number == 7934", "timestamp_epoch": "1580346134.620020000" }, { "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1580346135.620959000" }, { "frame_number": 7974, "display_filter": "frame.number == 7974", "timestamp_epoch": "1580346136.539734000" }, { "frame_number": 7976, "display_filter": "frame.number == 7976", "timestamp_epoch": "1580346136.545842000" }, { "frame_number": 7978, "display_filter": "frame.number == 7978", "timestamp_epoch": "1580346136.621248000" }, { "frame_number": 7979, "display_filter": "frame.number == 7979", "timestamp_epoch": "1580346136.725775000" }, { "frame_number": 7985, "display_filter": "frame.number == 7985", "timestamp_epoch": "1580346139.526402000" }, { "frame_number": 7986, "display_filter": "frame.number == 7986", "timestamp_epoch": "1580346139.543253000" }, { "frame_number": 7989, "display_filter": "frame.number == 7989", "timestamp_epoch": "1580346139.730927000" }, { "frame_number": 8043, "display_filter": "frame.number == 8043", "timestamp_epoch": "1580346142.542100000" }, { "frame_number": 8047, "display_filter": "frame.number == 8047", "timestamp_epoch": "1580346142.557724000" }, { "frame_number": 12867, "display_filter": "frame.number == 12867", "timestamp_epoch": "1580346253.474549000" }, { "frame_number": 12876, "display_filter": "frame.number == 12876", "timestamp_epoch": "1580346254.484734000" }, { "frame_number": 12879, "display_filter": "frame.number == 12879", "timestamp_epoch": "1580346255.484867000" }, { "frame_number": 12880, "display_filter": "frame.number == 12880", "timestamp_epoch": "1580346256.499874000" } ], "is_private": false, "observable_id": "observable-ad04550930cb710d0c81631d", "last_seen_epoch": "1580346256.499874000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346133.604864000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "31.13.93.174", "evidence": [ { "udp_stream": 99, "frame_number": 11217, "display_filter": "frame.number == 11217", "timestamp_epoch": "1580346176.960653000" }, { "udp_stream": 106, "frame_number": 12975, "display_filter": "frame.number == 12975", "timestamp_epoch": "1580346261.180031000" } ], "is_private": false, "observable_id": "observable-883ffbcddfe689831a77a683", "last_seen_epoch": "1580346261.180031000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.960653000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "31.13.93.35", "evidence": [ { "udp_stream": 98, "frame_number": 11079, "display_filter": "frame.number == 11079", "timestamp_epoch": "1580346176.916963000" }, { "udp_stream": 107, "frame_number": 12974, "display_filter": "frame.number == 12974", "timestamp_epoch": "1580346261.179938000" } ], "is_private": false, "observable_id": "observable-23c723131915f7cae90f0de8", "last_seen_epoch": "1580346261.179938000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.916963000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.66", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-8849a253195719fc37ef2afd", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.126.0.67", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-c6c2b7e412c21cd569c9be51", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.68", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-914f309aadb979a8ac3063af", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.69", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-4a1de74363ab18fff415b827", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.70", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-abbf043351133828ecd7ce44", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.72", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-223d076ef4d6e0efe0c251d0", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.73", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-172e585a11baf4b56d2af8b2", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.0.74", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "is_private": false, "observable_id": "observable-af18852879eeceffa6697aa9", "last_seen_epoch": "1580345751.503989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345751.503989000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.67.249.61", "evidence": [ { "udp_stream": 17, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1580345695.400755000" } ], "is_private": false, "observable_id": "observable-3841398f3d50c9d554ac4144", "last_seen_epoch": "1580345695.400755000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.400755000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "49.51.133.162", "evidence": [ { "udp_stream": 35, "frame_number": 1165, "display_filter": "frame.number == 1165", "timestamp_epoch": "1580345757.512836000" } ], "is_private": false, "observable_id": "observable-42464e03ae0ee709a86b8a00", "last_seen_epoch": "1580345757.512836000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345757.512836000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.109.76.30", "evidence": [ { "udp_stream": 47, "frame_number": 7724, "display_filter": "frame.number == 7724", "timestamp_epoch": "1580345984.336546000" } ], "is_private": false, "observable_id": "observable-1d02084e7a811c23b5d8daa5", "last_seen_epoch": "1580345984.336546000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345984.336546000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.132.22", "evidence": [ { "udp_stream": 40, "frame_number": 1356, "display_filter": "frame.number == 1356", "timestamp_epoch": "1580345761.097005000" } ], "is_private": false, "observable_id": "observable-81e130a889156166695e08c7", "last_seen_epoch": "1580345761.097005000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345761.097005000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.75.79", "evidence": [ { "udp_stream": 26, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1580345703.932605000" } ], "is_private": false, "observable_id": "observable-39ccf2e5a590e55915d67cce", "last_seen_epoch": "1580345703.932605000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345703.932605000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.242.211.89", "evidence": [ { "udp_stream": 28, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1580345705.530620000" }, { "udp_stream": 41, "frame_number": 3467, "display_filter": "frame.number == 3467", "timestamp_epoch": "1580345764.848131000" } ], "is_private": false, "observable_id": "observable-1bd6c0164e95636d95050593", "last_seen_epoch": "1580345764.848131000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345705.530620000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.235.203.7", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-31e82a216779dddb27b5bae1", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.235.220.229", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-013285e41cd98b06b36fcbcd", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "54.243.147.226", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "is_private": false, "observable_id": "observable-a638064567ccc2015d0659ca", "last_seen_epoch": "1580345758.355581000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.355581000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "81.177.6.156", "evidence": [ { "udp_stream": 37, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1580345758.668788000" }, { "udp_stream": 39, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1580345760.482013000" } ], "is_private": false, "observable_id": "observable-031640c390e2212650f453d1", "last_seen_epoch": "1580345760.482013000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.668788000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "28a2c9bd18a11de089ef85a160da29e4", "evidence": [ { "tcp_stream": 69, "frame_number": 7677, "display_filter": "frame.number == 7677", "timestamp_epoch": "1580345870.832298000" } ], "is_private": null, "observable_id": "observable-29ac2a31968b6ca21ff43724", "last_seen_epoch": "1580345870.832298000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345870.832298000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "37f463bf4616ecd445d4a1937da06e19", "evidence": [ { "tcp_stream": 61, "frame_number": 1398, "display_filter": "frame.number == 1398", "timestamp_epoch": "1580345761.150625000" }, { "tcp_stream": 78, "frame_number": 7869, "display_filter": "frame.number == 7869", "timestamp_epoch": "1580346113.588301000" }, { "tcp_stream": 79, "frame_number": 7873, "display_filter": "frame.number == 7873", "timestamp_epoch": "1580346113.627817000" } ], "is_private": null, "observable_id": "observable-58e3d6672b6f599e07311e72", "last_seen_epoch": "1580346113.627817000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345761.150625000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "3b5074b1b5d032e5620f69f9f700ff0e", "evidence": [ { "tcp_stream": 47, "frame_number": 942, "display_filter": "frame.number == 942", "timestamp_epoch": "1580345705.576845000" }, { "tcp_stream": 62, "frame_number": 3471, "display_filter": "frame.number == 3471", "timestamp_epoch": "1580345764.885473000" } ], "is_private": null, "observable_id": "observable-b607ea09dc33dfaaa09750fe", "last_seen_epoch": "1580345764.885473000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345705.576845000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "66918128f1b9b03303d77c6f2eefd128", "evidence": [ { "tcp_stream": 81, "frame_number": 7952, "display_filter": "frame.number == 7952", "timestamp_epoch": "1580346136.114901000" }, { "tcp_stream": 92, "frame_number": 8237, "display_filter": "frame.number == 8237", "timestamp_epoch": "1580346162.859161000" }, { "tcp_stream": 93, "frame_number": 8353, "display_filter": "frame.number == 8353", "timestamp_epoch": "1580346163.306491000" }, { "tcp_stream": 95, "frame_number": 8385, "display_filter": "frame.number == 8385", "timestamp_epoch": "1580346163.374824000" }, { "tcp_stream": 94, "frame_number": 8387, "display_filter": "frame.number == 8387", "timestamp_epoch": "1580346163.375214000" }, { "tcp_stream": 96, "frame_number": 8433, "display_filter": "frame.number == 8433", "timestamp_epoch": "1580346163.421483000" }, { "tcp_stream": 97, "frame_number": 8591, "display_filter": "frame.number == 8591", "timestamp_epoch": "1580346163.451141000" }, { "tcp_stream": 98, "frame_number": 8776, "display_filter": "frame.number == 8776", "timestamp_epoch": "1580346163.942156000" }, { "tcp_stream": 99, "frame_number": 8853, "display_filter": "frame.number == 8853", "timestamp_epoch": "1580346164.035709000" }, { "tcp_stream": 100, "frame_number": 8903, "display_filter": "frame.number == 8903", "timestamp_epoch": "1580346164.206635000" }, { "tcp_stream": 101, "frame_number": 8928, "display_filter": "frame.number == 8928", "timestamp_epoch": "1580346164.322115000" }, { "tcp_stream": 102, "frame_number": 8974, "display_filter": "frame.number == 8974", "timestamp_epoch": "1580346164.956726000" }, { "tcp_stream": 103, "frame_number": 9223, "display_filter": "frame.number == 9223", "timestamp_epoch": "1580346172.209981000" }, { "tcp_stream": 104, "frame_number": 9332, "display_filter": "frame.number == 9332", "timestamp_epoch": "1580346173.092854000" }, { "tcp_stream": 115, "frame_number": 10008, "display_filter": "frame.number == 10008", "timestamp_epoch": "1580346176.019853000" }, { "tcp_stream": 118, "frame_number": 10750, "display_filter": "frame.number == 10750", "timestamp_epoch": "1580346176.136362000" }, { "tcp_stream": 119, "frame_number": 11116, "display_filter": "frame.number == 11116", "timestamp_epoch": "1580346176.933425000" }, { "tcp_stream": 122, "frame_number": 11119, "display_filter": "frame.number == 11119", "timestamp_epoch": "1580346176.933874000" }, { "tcp_stream": 123, "frame_number": 11125, "display_filter": "frame.number == 11125", "timestamp_epoch": "1580346176.934528000" }, { "tcp_stream": 124, "frame_number": 11131, "display_filter": "frame.number == 11131", "timestamp_epoch": "1580346176.936624000" } ], "is_private": null, "observable_id": "observable-f7d9974aebf1153acf67ddb0", "last_seen_epoch": "1580346260.316460000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346136.114901000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "9e10692f1b7f78228b2d4e424db3a98c", "evidence": [ { "tcp_stream": 48, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1580345708.685523000" }, { "tcp_stream": 53, "frame_number": 1127, "display_filter": "frame.number == 1127", "timestamp_epoch": "1580345751.530306000" }, { "tcp_stream": 84, "frame_number": 8061, "display_filter": "frame.number == 8061", "timestamp_epoch": "1580346149.625887000" }, { "tcp_stream": 85, "frame_number": 8091, "display_filter": "frame.number == 8091", "timestamp_epoch": "1580346151.005528000" }, { "tcp_stream": 86, "frame_number": 8119, "display_filter": "frame.number == 8119", "timestamp_epoch": "1580346153.179668000" }, { "tcp_stream": 87, "frame_number": 8149, "display_filter": "frame.number == 8149", "timestamp_epoch": "1580346153.295097000" }, { "tcp_stream": 88, "frame_number": 8179, "display_filter": "frame.number == 8179", "timestamp_epoch": "1580346153.397126000" } ], "is_private": null, "observable_id": "observable-501327551c6466d256b42e7b", "last_seen_epoch": "1580346153.397126000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345708.685523000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "a0e9f5d64349fb13191bc781f81f42e1", "evidence": [ { "tcp_stream": 38, "frame_number": 800, "display_filter": "frame.number == 800", "timestamp_epoch": "1580345704.119816000" }, { "tcp_stream": 71, "frame_number": 7728, "display_filter": "frame.number == 7728", "timestamp_epoch": "1580345984.463481000" }, { "tcp_stream": 77, "frame_number": 7830, "display_filter": "frame.number == 7830", "timestamp_epoch": "1580346023.998910000" } ], "is_private": null, "observable_id": "observable-7ba9dba63f6a8f58150e33b6", "last_seen_epoch": "1580346023.998910000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345704.119816000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828", "evidence": [], "is_private": null, "observable_id": "observable-9d521be134da3e72b59df7db", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77", "evidence": [], "is_private": null, "observable_id": "observable-63f84859a3406312adec83ca", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3", "evidence": [], "is_private": null, "observable_id": "observable-eaacd15e41f91d6c1ca29b08", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df", "evidence": [], "is_private": null, "observable_id": "observable-69fb912ed988434ffb006473", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1", "evidence": [], "is_private": null, "observable_id": "observable-1be9c0f3bce145ea2a10ff25", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942", "evidence": [], "is_private": null, "observable_id": "observable-7a9411df725ba7981b23b319", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b", "evidence": [], "is_private": null, "observable_id": "observable-c09361fb6437117f35c94cac", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e", "evidence": [], "is_private": null, "observable_id": "observable-09ac6441fdb5713709bfba7d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015", "evidence": [], "is_private": null, "observable_id": "observable-112487ec52123a06fa02de1c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de", "evidence": [], "is_private": null, "observable_id": "observable-0266156ea6ddc254c352f4be", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88", "evidence": [], "is_private": null, "observable_id": "observable-c02586821f041a395f1a6adf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149", "evidence": [], "is_private": null, "observable_id": "observable-82fbff5f782ef185c35a9620", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d", "evidence": [], "is_private": null, "observable_id": "observable-714f45dfa844cb188e7ee515", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b", "evidence": [], "is_private": null, "observable_id": "observable-f7016c5b0654926a5cbde01c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5", "evidence": [], "is_private": null, "observable_id": "observable-7d1953d4d07dcc82df1e4e6d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75", "evidence": [], "is_private": null, "observable_id": "observable-de552a71f3d15f67679f4db1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50", "evidence": [], "is_private": null, "observable_id": "observable-843928b623f06e5aae3fd9d7", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795", "evidence": [], "is_private": null, "observable_id": "observable-a8a86e6b171129dc6af6c9f4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b", "evidence": [], "is_private": null, "observable_id": "observable-16e757516b3480d66a910ff9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3", "evidence": [], "is_private": null, "observable_id": "observable-a5e8aec64a45d584b8ec5d8d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f", "evidence": [], "is_private": null, "observable_id": "observable-9b263313321ce68c560b9727", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b", "evidence": [], "is_private": null, "observable_id": "observable-ba5e367739284c4904191a3e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d", "evidence": [], "is_private": null, "observable_id": "observable-3c3351a534cdd79808b1bd0c", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9", "evidence": [], "is_private": null, "observable_id": "observable-9d6f248cad461b3e49b8697f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e", "evidence": [], "is_private": null, "observable_id": "observable-6907491499439574413f60e5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619", "evidence": [], "is_private": null, "observable_id": "observable-baecdce94f907f854bbf11db", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3", "evidence": [], "is_private": null, "observable_id": "observable-195aa655c7efc2b246844cca", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09", "evidence": [], "is_private": null, "observable_id": "observable-9b251bc299224fd7cce02361", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d", "evidence": [], "is_private": null, "observable_id": "observable-4c43efb0ebc983217bcbe27a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c", "evidence": [], "is_private": null, "observable_id": "observable-589952c6f2ae3283d591caea", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398", "evidence": [], "is_private": null, "observable_id": "observable-cbf5ed147d2b38fdf9353ac3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f", "evidence": [], "is_private": null, "observable_id": "observable-a16335d022f719dee6878c71", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d", "evidence": [], "is_private": null, "observable_id": "observable-432c5d3c1a5191a0175b39ea", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7", "evidence": [], "is_private": null, "observable_id": "observable-d77d0ecd5ed43335a522bea1", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55", "evidence": [], "is_private": null, "observable_id": "observable-e50be9e49489cc0e57b66081", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16", "evidence": [], "is_private": null, "observable_id": "observable-284b73b8289bf703858daed4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94", "evidence": [], "is_private": null, "observable_id": "observable-24cba99c76f55e6dc0417069", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7", "evidence": [], "is_private": null, "observable_id": "observable-8a0f1fea0e01325b249d2870", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72", "evidence": [], "is_private": null, "observable_id": "observable-38e4baf0eb45a9f5788b23de", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36", "evidence": [], "is_private": null, "observable_id": "observable-f316232c786e900541ed90f2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20", "evidence": [], "is_private": null, "observable_id": "observable-540959b1b4d50eadb57c79fe", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e", "evidence": [], "is_private": null, "observable_id": "observable-9ede59840bac1c9d6e24d908", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6", "evidence": [], "is_private": null, "observable_id": "observable-8bfacdcd218ae40689c6ee81", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6", "evidence": [], "is_private": null, "observable_id": "observable-b1c471a21c471c59150de718", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda", "evidence": [], "is_private": null, "observable_id": "observable-d51dc7b9ecca62246fcada44", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed", "evidence": [], "is_private": null, "observable_id": "observable-b5a87b20bc4af3e66a1554a2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37", "evidence": [], "is_private": null, "observable_id": "observable-9262860a21159fc0a9b0b407", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa", "evidence": [], "is_private": null, "observable_id": "observable-45840d2f074d84582b0072fb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30", "evidence": [], "is_private": null, "observable_id": "observable-a8b6a456dcaed205c615a8f8", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce", "evidence": [], "is_private": null, "observable_id": "observable-4d6e5bba0125f1aa2f23af5e", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "evidence": [], "is_private": null, "observable_id": "observable-dacbd932fb79f09c9740c732", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0", "evidence": [], "is_private": null, "observable_id": "observable-7544d358b0eafe514ff7e810", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e", "evidence": [], "is_private": null, "observable_id": "observable-72382c14f5bec01dda7cdbad", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00", "evidence": [], "is_private": null, "observable_id": "observable-72a395fbcea73a3e403f2d50", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd", "evidence": [], "is_private": null, "observable_id": "observable-5fe8175c429d2a000f733dae", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443", "evidence": [], "is_private": null, "observable_id": "observable-995a3003316fa535b188c81f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1", "evidence": [], "is_private": null, "observable_id": "observable-c9cd62e25629282e7a824ffb", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1", "evidence": [], "is_private": null, "observable_id": "observable-005ca455919f97b2d0c5fe79", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e", "evidence": [], "is_private": null, "observable_id": "observable-c6bcb782844c3876d9d6fd56", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5", "evidence": [], "is_private": null, "observable_id": "observable-34b965f5592111595acc9a2d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f", "evidence": [], "is_private": null, "observable_id": "observable-2ece8a6eedaa842d5fb8882a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf", "evidence": [], "is_private": null, "observable_id": "observable-b2c8e089a256a05f96ae56f5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db", "evidence": [], "is_private": null, "observable_id": "observable-5810ceb7ddcd661f963a09e2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "evidence": [], "is_private": null, "observable_id": "observable-421b7eeff0d382936b264638", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200", "evidence": [], "is_private": null, "observable_id": "observable-3e6117dca0094872e11fdefd", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12", "evidence": [], "is_private": null, "observable_id": "observable-9ac5800bf07d5cf2d8784de3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627", "evidence": [], "is_private": null, "observable_id": "observable-f831446ad2c72392b2893ba4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d", "evidence": [], "is_private": null, "observable_id": "observable-d187c4e7c1bcf536ccea27b9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774", "evidence": [], "is_private": null, "observable_id": "observable-fc13354084058fe97ecd7f72", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588", "evidence": [], "is_private": null, "observable_id": "observable-06887eb5bec2f55d7cbb84a3", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://239.255.255.250:1900*", "evidence": [ { "frame_number": 7927, "display_filter": "frame.number == 7927", "timestamp_epoch": "1580346133.604864000" }, { "frame_number": 7934, "display_filter": "frame.number == 7934", "timestamp_epoch": "1580346134.620020000" }, { "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1580346135.620959000" }, { "frame_number": 7974, "display_filter": "frame.number == 7974", "timestamp_epoch": "1580346136.539734000" }, { "frame_number": 7976, "display_filter": "frame.number == 7976", "timestamp_epoch": "1580346136.545842000" }, { "frame_number": 7978, "display_filter": "frame.number == 7978", "timestamp_epoch": "1580346136.621248000" }, { "frame_number": 7979, "display_filter": "frame.number == 7979", "timestamp_epoch": "1580346136.725775000" }, { "frame_number": 7985, "display_filter": "frame.number == 7985", "timestamp_epoch": "1580346139.526402000" }, { "frame_number": 7986, "display_filter": "frame.number == 7986", "timestamp_epoch": "1580346139.543253000" }, { "frame_number": 7989, "display_filter": "frame.number == 7989", "timestamp_epoch": "1580346139.730927000" }, { "frame_number": 8043, "display_filter": "frame.number == 8043", "timestamp_epoch": "1580346142.542100000" }, { "frame_number": 8047, "display_filter": "frame.number == 8047", "timestamp_epoch": "1580346142.557724000" }, { "frame_number": 12867, "display_filter": "frame.number == 12867", "timestamp_epoch": "1580346253.474549000" }, { "frame_number": 12876, "display_filter": "frame.number == 12876", "timestamp_epoch": "1580346254.484734000" }, { "frame_number": 12879, "display_filter": "frame.number == 12879", "timestamp_epoch": "1580346255.484867000" }, { "frame_number": 12880, "display_filter": "frame.number == 12880", "timestamp_epoch": "1580346256.499874000" } ], "is_private": null, "observable_id": "observable-c0c4500a2dfb08d7a1aeb649", "last_seen_epoch": "1580346256.499874000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346133.604864000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://api.ipify.org/", "evidence": [ { "tcp_stream": 56, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1580345758.403785000" } ], "is_private": null, "observable_id": "observable-397d4cd1b0f27b35801c1eea", "last_seen_epoch": "1580345758.403785000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.403785000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://assets.squarespace.com/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js", "evidence": [ { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" } ], "is_private": null, "observable_id": "observable-8cef4822b3408d106f86a52e", "last_seen_epoch": "1580346176.011929000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.011929000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://assets.squarespace.com/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js", "evidence": [ { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" } ], "is_private": null, "observable_id": "observable-2f7584ac351b5d915a3983b7", "last_seen_epoch": "1580346176.011638000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.011638000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://assets.squarespace.com/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js", "evidence": [ { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" } ], "is_private": null, "observable_id": "observable-cb648f4a1703a47a60523029", "last_seen_epoch": "1580346176.012077000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.012077000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://assets.squarespace.com/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css", "evidence": [ { "tcp_stream": 111, "frame_number": 9999, "display_filter": "frame.number == 9999", "timestamp_epoch": "1580346176.012348000" } ], "is_private": null, "observable_id": "observable-cd9c09580ebe685dc6284dd8", "last_seen_epoch": "1580346176.012348000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.012348000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dmd.metaservices.microsoft.com/metadata.svc", "evidence": [ { "tcp_stream": 24, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1580345695.523568000" }, { "tcp_stream": 24, "frame_number": 531, "display_filter": "frame.number == 531", "timestamp_epoch": "1580345695.893444000" } ], "is_private": null, "observable_id": "observable-f58393f974d06fc32ca6d88b", "last_seen_epoch": "1580345695.893444000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.523568000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Lato:100,400,700i,700,400i", "evidence": [ { "tcp_stream": 113, "frame_number": 10016, "display_filter": "frame.number == 10016", "timestamp_epoch": "1580346176.022922000" } ], "is_private": null, "observable_id": "observable-c892d61ecb65083ff57b9878", "last_seen_epoch": "1580346176.022922000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.022922000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Google+Sans", "evidence": [ { "tcp_stream": 113, "frame_number": 13471, "display_filter": "frame.number == 13471", "timestamp_epoch": "1580346262.041421000" } ], "is_private": null, "observable_id": "observable-3bfec01145eb502c3c3676b1", "last_seen_epoch": "1580346262.041421000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346262.041421000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2", "evidence": [ { "tcp_stream": 121, "frame_number": 11122, "display_filter": "frame.number == 11122", "timestamp_epoch": "1580346176.934102000" } ], "is_private": null, "observable_id": "observable-e9dbbffec9b9ee5fefb6b15a", "last_seen_epoch": "1580346176.934102000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.934102000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2", "evidence": [ { "tcp_stream": 120, "frame_number": 11111, "display_filter": "frame.number == 11111", "timestamp_epoch": "1580346176.932931000" } ], "is_private": null, "observable_id": "observable-c8918524b4dccf608f2d5c57", "last_seen_epoch": "1580346176.932931000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.932931000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2", "evidence": [ { "tcp_stream": 117, "frame_number": 11080, "display_filter": "frame.number == 11080", "timestamp_epoch": "1580346176.917041000" } ], "is_private": null, "observable_id": "observable-416705e38e9d91cef55722f8", "last_seen_epoch": "1580346176.917041000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.917041000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2", "evidence": [ { "tcp_stream": 121, "frame_number": 13483, "display_filter": "frame.number == 13483", "timestamp_epoch": "1580346262.089124000" } ], "is_private": null, "observable_id": "observable-d10a566aa06663c5f9d07c84", "last_seen_epoch": "1580346262.089124000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346262.089124000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://gengrasjeepram.com/sv.exe", "evidence": [ { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" } ], "is_private": null, "observable_id": "observable-5ee11d7f0f03366ccc564a42", "last_seen_epoch": "1580345757.655509000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345757.655509000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409", "evidence": [ { "tcp_stream": 23, "frame_number": 492, "display_filter": "frame.number == 492", "timestamp_epoch": "1580345695.322080000" }, { "tcp_stream": 25, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1580345695.834804000" } ], "is_private": null, "observable_id": "observable-01f3d1be14a42be5b28bd0e1", "last_seen_epoch": "1580345695.834804000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.322080000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://google.com/", "evidence": [ { "tcp_stream": 89, "frame_number": 8222, "display_filter": "frame.number == 8222", "timestamp_epoch": "1580346162.739566000" } ], "is_private": null, "observable_id": "observable-b91a028e318b290c4a352225", "last_seen_epoch": "1580346162.739566000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.739566000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3317&z=13", "evidence": [ { "tcp_stream": 140, "frame_number": 13217, "display_filter": "frame.number == 13217", "timestamp_epoch": "1580346261.530661000" } ], "is_private": null, "observable_id": "observable-818499bfed2122aee67974c9", "last_seen_epoch": "1580346261.530661000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.530661000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3318&z=13", "evidence": [ { "tcp_stream": 139, "frame_number": 13203, "display_filter": "frame.number == 13203", "timestamp_epoch": "1580346261.528788000" } ], "is_private": null, "observable_id": "observable-111c7c2228fedd3af4315f4e", "last_seen_epoch": "1580346261.528788000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.528788000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3317&z=13", "evidence": [ { "tcp_stream": 142, "frame_number": 13219, "display_filter": "frame.number == 13219", "timestamp_epoch": "1580346261.530786000" } ], "is_private": null, "observable_id": "observable-4ebe261c5a059af9955af99a", "last_seen_epoch": "1580346261.530786000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.530786000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3318&z=13", "evidence": [ { "tcp_stream": 141, "frame_number": 13215, "display_filter": "frame.number == 13215", "timestamp_epoch": "1580346261.530511000" } ], "is_private": null, "observable_id": "observable-f88f1362dd03d3dff3272430", "last_seen_epoch": "1580346261.530511000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.530511000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3317&z=13", "evidence": [ { "tcp_stream": 143, "frame_number": 13221, "display_filter": "frame.number == 13221", "timestamp_epoch": "1580346261.530932000" } ], "is_private": null, "observable_id": "observable-0c6ab188f7b8fac09057ff11", "last_seen_epoch": "1580346261.530932000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.530932000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3318&z=13", "evidence": [ { "tcp_stream": 144, "frame_number": 13223, "display_filter": "frame.number == 13223", "timestamp_epoch": "1580346261.531130000" } ], "is_private": null, "observable_id": "observable-da91a80e98e43b1920f564db", "last_seen_epoch": "1580346261.531130000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.531130000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/common.js", "evidence": [ { "tcp_stream": 134, "frame_number": 13042, "display_filter": "frame.number == 13042", "timestamp_epoch": "1580346261.292989000" } ], "is_private": null, "observable_id": "observable-5b53b0b74e02537e55c4400f", "last_seen_epoch": "1580346261.292989000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.292989000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/controls.js", "evidence": [ { "tcp_stream": 137, "frame_number": 13407, "display_filter": "frame.number == 13407", "timestamp_epoch": "1580346261.955338000" } ], "is_private": null, "observable_id": "observable-62239c4de827140359777851", "last_seen_epoch": "1580346261.955338000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.955338000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/map.js", "evidence": [ { "tcp_stream": 137, "frame_number": 13054, "display_filter": "frame.number == 13054", "timestamp_epoch": "1580346261.352375000" } ], "is_private": null, "observable_id": "observable-6be4ba5eb88eacf79f889347", "last_seen_epoch": "1580346261.352375000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.352375000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/marker.js", "evidence": [ { "tcp_stream": 136, "frame_number": 13056, "display_filter": "frame.number == 13056", "timestamp_epoch": "1580346261.352557000" } ], "is_private": null, "observable_id": "observable-09302b77d38eb71860198b27", "last_seen_epoch": "1580346261.352557000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.352557000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/onion.js", "evidence": [ { "tcp_stream": 135, "frame_number": 13167, "display_filter": "frame.number == 13167", "timestamp_epoch": "1580346261.465995000" } ], "is_private": null, "observable_id": "observable-b3f27b37fc292ddf9071cd92", "last_seen_epoch": "1580346261.465995000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.465995000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/stats.js", "evidence": [ { "tcp_stream": 137, "frame_number": 13169, "display_filter": "frame.number == 13169", "timestamp_epoch": "1580346261.466132000" } ], "is_private": null, "observable_id": "observable-f33fa8b30ac0930caffdd394", "last_seen_epoch": "1580346261.466132000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.466132000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/util.js", "evidence": [ { "tcp_stream": 135, "frame_number": 13052, "display_filter": "frame.number == 13052", "timestamp_epoch": "1580346261.352193000" } ], "is_private": null, "observable_id": "observable-95a55fb78253b4551234a006", "last_seen_epoch": "1580346261.352193000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.352193000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 146, "frame_number": 13409, "display_filter": "frame.number == 13409", "timestamp_epoch": "1580346261.955975000" } ], "is_private": null, "observable_id": "observable-eddde6e5ec75a657f760bd12", "last_seen_epoch": "1580346261.955975000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.955975000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 146, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1580346262.073117000" } ], "is_private": null, "observable_id": "observable-6332f0dd29ac1493092e0454", "last_seen_epoch": "1580346262.073117000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346262.073117000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 135, "frame_number": 13187, "display_filter": "frame.number == 13187", "timestamp_epoch": "1580346261.491507000" } ], "is_private": null, "observable_id": "observable-ac4a9fff9ae6d2db44e52817", "last_seen_epoch": "1580346261.491507000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.491507000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US", "evidence": [ { "tcp_stream": 134, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1580346261.207430000" } ], "is_private": null, "observable_id": "observable-dc4880e16938d7d9167fb159", "last_seen_epoch": "1580346261.207430000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.207430000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 137, "frame_number": 13385, "display_filter": "frame.number == 13385", "timestamp_epoch": "1580346261.639565000" } ], "is_private": null, "observable_id": "observable-93f92af25fc73b633ad2d15e", "last_seen_epoch": "1580346261.639565000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.639565000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 136, "frame_number": 13364, "display_filter": "frame.number == 13364", "timestamp_epoch": "1580346261.598688000" } ], "is_private": null, "observable_id": "observable-a0d4c6c6b08c11c41e29a807", "last_seen_epoch": "1580346261.598688000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.598688000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 137, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1580346261.597334000" } ], "is_private": null, "observable_id": "observable-bc463e71bce5341bfcdc9e25", "last_seen_epoch": "1580346261.597334000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.597334000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 134, "frame_number": 13366, "display_filter": "frame.number == 13366", "timestamp_epoch": "1580346261.599495000" } ], "is_private": null, "observable_id": "observable-0503c207937dbddb12ca1f5e", "last_seen_epoch": "1580346261.599495000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.599495000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 135, "frame_number": 13360, "display_filter": "frame.number == 13360", "timestamp_epoch": "1580346261.596304000" } ], "is_private": null, "observable_id": "observable-8ebdee35f5a78e75118e6251", "last_seen_epoch": "1580346261.596304000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.596304000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 146, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1580346261.614212000" } ], "is_private": null, "observable_id": "observable-84b607894491f59154e50589", "last_seen_epoch": "1580346261.614212000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.614212000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "evidence": [ { "tcp_stream": 147, "frame_number": 13379, "display_filter": "frame.number == 13379", "timestamp_epoch": "1580346261.614438000" } ], "is_private": null, "observable_id": "observable-6807d361175b5a3f8f34bb1c", "last_seen_epoch": "1580346261.614438000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.614438000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.gstatic.com/mapfiles/api-3/images/google_white5.png", "evidence": [ { "tcp_stream": 145, "frame_number": 13474, "display_filter": "frame.number == 13474", "timestamp_epoch": "1580346262.061304000" } ], "is_private": null, "observable_id": "observable-98013dabde1f9bb895191a24", "last_seen_epoch": "1580346262.061304000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346262.061304000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.gstatic.com/mapfiles/api-3/images/spotlight-poi2.png", "evidence": [ { "tcp_stream": 145, "frame_number": 13353, "display_filter": "frame.number == 13353", "timestamp_epoch": "1580346261.578833000" } ], "is_private": null, "observable_id": "observable-3372e69ee3708c32b200554d", "last_seen_epoch": "1580346261.578833000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.578833000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.gstatic.com/mapfiles/openhand_8_8.cur", "evidence": [ { "tcp_stream": 138, "frame_number": 13191, "display_filter": "frame.number == 13191", "timestamp_epoch": "1580346261.504672000" } ], "is_private": null, "observable_id": "observable-c65e26c6c24a9d1d4b624374", "last_seen_epoch": "1580346261.504672000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.504672000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://maps.gstatic.com/mapfiles/transparent.png", "evidence": [ { "tcp_stream": 138, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1580346261.557116000" } ], "is_private": null, "observable_id": "observable-ca8f1916066e907682793cc7", "last_seen_epoch": "1580346261.557116000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.557116000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://static1.squarespace.com/static/531a38d5e4b06ab55728bbcd/t/535732bde4b0ff45f1eff4ee/1575563567328/?format=1500w", "evidence": [ { "tcp_stream": 116, "frame_number": 10012, "display_filter": "frame.number == 10012", "timestamp_epoch": "1580346176.020274000" } ], "is_private": null, "observable_id": "observable-44782dd76609b8b2d37b5ee8", "last_seen_epoch": "1580346176.020274000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.020274000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://static1.squarespace.com/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false", "evidence": [ { "tcp_stream": 114, "frame_number": 10010, "display_filter": "frame.number == 10010", "timestamp_epoch": "1580346176.020125000" } ], "is_private": null, "observable_id": "observable-ec8a08db34366d2c624d9139", "last_seen_epoch": "1580346176.020125000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.020125000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://twereptale.com/4/forum.php", "evidence": [ { "tcp_stream": 57, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1580345758.838022000" }, { "tcp_stream": 70, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1580345885.104183000" }, { "tcp_stream": 76, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1580346005.497228000" }, { "tcp_stream": 80, "frame_number": 7916, "display_filter": "frame.number == 7916", "timestamp_epoch": "1580346125.870845000" }, { "tcp_stream": 127, "frame_number": 12855, "display_filter": "frame.number == 12855", "timestamp_epoch": "1580346246.270378000" } ], "is_private": null, "observable_id": "observable-7985bdca94eb1024408f1479", "last_seen_epoch": "1580346246.270378000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.838022000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://twereptale.com/d2/about.php", "evidence": [ { "tcp_stream": 63, "frame_number": 3586, "display_filter": "frame.number == 3586", "timestamp_epoch": "1580345765.163080000" } ], "is_private": null, "observable_id": "observable-7fd0e5c321e1064c075b69ae", "last_seen_epoch": "1580345765.163080000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345765.163080000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://twereptale.com/mlu/forum.php", "evidence": [ { "tcp_stream": 59, "frame_number": 1315, "display_filter": "frame.number == 1315", "timestamp_epoch": "1580345760.647757000" } ], "is_private": null, "observable_id": "observable-a0ba914d6201af4d4fe67664", "last_seen_epoch": "1580345760.647757000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345760.647757000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://use.typekit.net/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js", "evidence": [ { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" } ], "is_private": null, "observable_id": "observable-33afca492ae11265ce0e7a11", "last_seen_epoch": "1580346176.004846000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.004846000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google.com/", "evidence": [ { "tcp_stream": 91, "frame_number": 8231, "display_filter": "frame.number == 8231", "timestamp_epoch": "1580346162.810738000" } ], "is_private": null, "observable_id": "observable-bac7b5716299dc964d46e47d", "last_seen_epoch": "1580346162.810738000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.810738000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L", "evidence": [ { "tcp_stream": 91, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1580346175.652447000" } ], "is_private": null, "observable_id": "observable-9c4572a8e16ea1f1647c2f12", "last_seen_epoch": "1580346175.652447000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.652447000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/", "evidence": [ { "tcp_stream": 106, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1580346175.871552000" } ], "is_private": null, "observable_id": "observable-bbb59665f8c5fe3189dc7f5a", "last_seen_epoch": "1580346175.871552000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346175.871552000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/api/1/performance/records", "evidence": [ { "tcp_stream": 129, "frame_number": 12912, "display_filter": "frame.number == 12912", "timestamp_epoch": "1580346260.315953000" }, { "tcp_stream": 128, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1580346260.376231000" } ], "is_private": null, "observable_id": "observable-21d01a581f0978b8a3216753", "last_seen_epoch": "1580346260.376231000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346260.315953000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/api/1/performance/settings", "evidence": [ { "tcp_stream": 107, "frame_number": 11073, "display_filter": "frame.number == 11073", "timestamp_epoch": "1580346176.893673000" }, { "tcp_stream": 133, "frame_number": 12979, "display_filter": "frame.number == 12979", "timestamp_epoch": "1580346261.183798000" } ], "is_private": null, "observable_id": "observable-a976af9dc53d855804124e34", "last_seen_epoch": "1580346261.183798000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.893673000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/api/census/form-render", "evidence": [ { "tcp_stream": 132, "frame_number": 12962, "display_filter": "frame.number == 12962", "timestamp_epoch": "1580346261.128864000" } ], "is_private": null, "observable_id": "observable-b2794fd0d9f5162ebecf869a", "last_seen_epoch": "1580346261.128864000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.128864000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/api/census/RecordHit", "evidence": [ { "tcp_stream": 106, "frame_number": 11070, "display_filter": "frame.number == 11070", "timestamp_epoch": "1580346176.888399000" }, { "tcp_stream": 128, "frame_number": 12957, "display_filter": "frame.number == 12957", "timestamp_epoch": "1580346261.126327000" } ], "is_private": null, "observable_id": "observable-9ac79003e9dac9380464fe5a", "last_seen_epoch": "1580346261.126327000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346176.888399000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/api/events/RecordEvent", "evidence": [ { "tcp_stream": 129, "frame_number": 12960, "display_filter": "frame.number == 12960", "timestamp_epoch": "1580346261.127758000" } ], "is_private": null, "observable_id": "observable-8686208170d18d4555537a2b", "last_seen_epoch": "1580346261.127758000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346261.127758000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://www.tippingpointhampstead.com/contact", "evidence": [ { "tcp_stream": 128, "frame_number": 12904, "display_filter": "frame.number == 12904", "timestamp_epoch": "1580346260.307088000" } ], "is_private": null, "observable_id": "observable-f69610f91794cba00ec2d5de", "last_seen_epoch": "1580346260.307088000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346260.307088000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://xolightfinance.com/bhola/images/1", "evidence": [ { "tcp_stream": 58, "frame_number": 1260, "display_filter": "frame.number == 1260", "timestamp_epoch": "1580345759.390149000" } ], "is_private": null, "observable_id": "observable-0c7194426c8d6feb30d48229", "last_seen_epoch": "1580345759.390149000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345759.390149000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://xolightfinance.com/bhola/images/2", "evidence": [ { "tcp_stream": 58, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1580345764.042624000" } ], "is_private": null, "observable_id": "observable-7da572e090eff6850ff68062", "last_seen_epoch": "1580345764.042624000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345764.042624000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft Edge/79.0.309.71 Windows", "evidence": [ { "frame_number": 7927, "display_filter": "frame.number == 7927", "timestamp_epoch": "1580346133.604864000" }, { "frame_number": 7934, "display_filter": "frame.number == 7934", "timestamp_epoch": "1580346134.620020000" }, { "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1580346135.620959000" }, { "frame_number": 7978, "display_filter": "frame.number == 7978", "timestamp_epoch": "1580346136.621248000" }, { "frame_number": 12867, "display_filter": "frame.number == 12867", "timestamp_epoch": "1580346253.474549000" }, { "frame_number": 12876, "display_filter": "frame.number == 12876", "timestamp_epoch": "1580346254.484734000" }, { "frame_number": 12879, "display_filter": "frame.number == 12879", "timestamp_epoch": "1580346255.484867000" }, { "frame_number": 12880, "display_filter": "frame.number == 12880", "timestamp_epoch": "1580346256.499874000" } ], "is_private": null, "observable_id": "observable-c4c635b74febb4b87a0d59e4", "last_seen_epoch": "1580346256.499874000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346133.604864000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT", "evidence": [ { "tcp_stream": 23, "frame_number": 492, "display_filter": "frame.number == 492", "timestamp_epoch": "1580345695.322080000" }, { "tcp_stream": 24, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1580345695.523568000" }, { "tcp_stream": 25, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1580345695.834804000" }, { "tcp_stream": 24, "frame_number": 531, "display_filter": "frame.number == 531", "timestamp_epoch": "1580345695.893444000" } ], "is_private": null, "observable_id": "observable-b858aeda36ae302c1b521ca9", "last_seen_epoch": "1580345695.893444000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345695.322080000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" }, { "tcp_stream": 63, "frame_number": 3586, "display_filter": "frame.number == 3586", "timestamp_epoch": "1580345765.163080000" } ], "is_private": null, "observable_id": "observable-80ba7f345245fdd0bfca1c03", "last_seen_epoch": "1580345765.163080000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345757.655509000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E)", "evidence": [ { "tcp_stream": 59, "frame_number": 1315, "display_filter": "frame.number == 1315", "timestamp_epoch": "1580345760.647757000" } ], "is_private": null, "observable_id": "observable-eab64cb8efa2899c0eaa9d35", "last_seen_epoch": "1580345760.647757000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345760.647757000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36 Edg/79.0.309.71", "evidence": [ { "tcp_stream": 89, "frame_number": 8222, "display_filter": "frame.number == 8222", "timestamp_epoch": "1580346162.739566000" }, { "tcp_stream": 91, "frame_number": 8231, "display_filter": "frame.number == 8231", "timestamp_epoch": "1580346162.810738000" }, { "tcp_stream": 91, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1580346175.652447000" }, { "tcp_stream": 106, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1580346175.871552000" }, { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" }, { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" }, { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" }, { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" }, { "tcp_stream": 111, "frame_number": 9999, "display_filter": "frame.number == 9999", "timestamp_epoch": "1580346176.012348000" }, { "tcp_stream": 114, "frame_number": 10010, "display_filter": "frame.number == 10010", "timestamp_epoch": "1580346176.020125000" }, { "tcp_stream": 116, "frame_number": 10012, "display_filter": "frame.number == 10012", "timestamp_epoch": "1580346176.020274000" }, { "tcp_stream": 113, "frame_number": 10016, "display_filter": "frame.number == 10016", "timestamp_epoch": "1580346176.022922000" }, { "tcp_stream": 106, "frame_number": 11070, "display_filter": "frame.number == 11070", "timestamp_epoch": "1580346176.888399000" }, { "tcp_stream": 107, "frame_number": 11073, "display_filter": "frame.number == 11073", "timestamp_epoch": "1580346176.893673000" }, { "tcp_stream": 117, "frame_number": 11080, "display_filter": "frame.number == 11080", "timestamp_epoch": "1580346176.917041000" }, { "tcp_stream": 120, "frame_number": 11111, "display_filter": "frame.number == 11111", "timestamp_epoch": "1580346176.932931000" }, { "tcp_stream": 121, "frame_number": 11122, "display_filter": "frame.number == 11122", "timestamp_epoch": "1580346176.934102000" }, { "tcp_stream": 128, "frame_number": 12904, "display_filter": "frame.number == 12904", "timestamp_epoch": "1580346260.307088000" }, { "tcp_stream": 129, "frame_number": 12912, "display_filter": "frame.number == 12912", "timestamp_epoch": "1580346260.315953000" }, { "tcp_stream": 128, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1580346260.376231000" } ], "is_private": null, "observable_id": "observable-5a778a6ee67ca3f605db52b3", "last_seen_epoch": "1580346262.089124000", "enrichment_state": "not_requested", "first_seen_epoch": "1580346162.739566000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; rv:11.0) like Gecko", "evidence": [ { "tcp_stream": 56, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1580345758.403785000" }, { "tcp_stream": 57, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1580345758.838022000" }, { "tcp_stream": 58, "frame_number": 1260, "display_filter": "frame.number == 1260", "timestamp_epoch": "1580345759.390149000" }, { "tcp_stream": 58, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1580345764.042624000" }, { "tcp_stream": 70, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1580345885.104183000" }, { "tcp_stream": 76, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1580346005.497228000" }, { "tcp_stream": 80, "frame_number": 7916, "display_filter": "frame.number == 7916", "timestamp_epoch": "1580346125.870845000" }, { "tcp_stream": 127, "frame_number": 12855, "display_filter": "frame.number == 12855", "timestamp_epoch": "1580346246.270378000" } ], "is_private": null, "observable_id": "observable-08e6550d286874dcb9d98b7e", "last_seen_epoch": "1580346246.270378000", "enrichment_state": "not_requested", "first_seen_epoch": "1580345758.403785000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "058c1af6f71cde55e06a5ff1ac15ceb6974d302dcb74abe1bc455994ba1d18e4", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [ { "name": "Ingress Tool Transfer", "status": "suggested", "tactic": "command-and-control", "evidence": [ { "tcp_stream": 110, "frame_number": 10068, "display_filter": "frame.number == 10068", "timestamp_epoch": "1580346176.028615000" }, { "tcp_stream": 108, "frame_number": 10081, "display_filter": "frame.number == 10081", "timestamp_epoch": "1580346176.032853000" }, { "tcp_stream": 112, "frame_number": 10645, "display_filter": "frame.number == 10645", "timestamp_epoch": "1580346176.084402000" }, { "tcp_stream": 109, "frame_number": 10744, "display_filter": "frame.number == 10744", "timestamp_epoch": "1580346176.105860000" }, { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" }, { "tcp_stream": 55, "frame_number": 1235, "display_filter": "frame.number == 1235", "timestamp_epoch": "1580345758.042190000" }, { "tcp_stream": 134, "frame_number": 13042, "display_filter": "frame.number == 13042", "timestamp_epoch": "1580346261.292989000" }, { "tcp_stream": 135, "frame_number": 13052, "display_filter": "frame.number == 13052", "timestamp_epoch": "1580346261.352193000" }, { "tcp_stream": 137, "frame_number": 13054, "display_filter": "frame.number == 13054", "timestamp_epoch": "1580346261.352375000" }, { "tcp_stream": 136, "frame_number": 13056, "display_filter": "frame.number == 13056", "timestamp_epoch": "1580346261.352557000" }, { "tcp_stream": 134, "frame_number": 13084, "display_filter": "frame.number == 13084", "timestamp_epoch": "1580346261.358580000" }, { "tcp_stream": 136, "frame_number": 13093, "display_filter": "frame.number == 13093", "timestamp_epoch": "1580346261.364830000" }, { "tcp_stream": 137, "frame_number": 13121, "display_filter": "frame.number == 13121", "timestamp_epoch": "1580346261.378909000" }, { "tcp_stream": 135, "frame_number": 13163, "display_filter": "frame.number == 13163", "timestamp_epoch": "1580346261.393381000" }, { "tcp_stream": 135, "frame_number": 13167, "display_filter": "frame.number == 13167", "timestamp_epoch": "1580346261.465995000" }, { "tcp_stream": 137, "frame_number": 13169, "display_filter": "frame.number == 13169", "timestamp_epoch": "1580346261.466132000" }, { "tcp_stream": 135, "frame_number": 13178, "display_filter": "frame.number == 13178", "timestamp_epoch": "1580346261.479483000" }, { "tcp_stream": 137, "frame_number": 13181, "display_filter": "frame.number == 13181", "timestamp_epoch": "1580346261.481061000" }, { "tcp_stream": 137, "frame_number": 13407, "display_filter": "frame.number == 13407", "timestamp_epoch": "1580346261.955338000" }, { "tcp_stream": 137, "frame_number": 13467, "display_filter": "frame.number == 13467", "timestamp_epoch": "1580346261.986607000" }, { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" }, { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" }, { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" }, { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" } ], "attack_id": "T1105", "confidence": 0.8, "finding_ids": [ "finding-00a3c361afe555454283e7e2", "finding-0d80335700324abd75053acd", "finding-2de112f88dcf83156a81f951", "finding-61f23c4390a76eb7d104922c", "finding-63c5f8bba06307a1c7217aec", "finding-7928e3b2b55de1c0acbe63aa", "finding-811cd3e7daca098ea9c5f254", "finding-8662d88305eabe87cdf18070", "finding-a2f92a8d5028870f86eb845a", "finding-a37c3f190d19cebee4affcb6", "finding-c4001dbe2ad3e10ae1bdc25d", "finding-eb736237e3e0f5b1a36937ad" ], "mapping_basis": "versioned-deterministic-rule" } ], "analysis_key_material": { "source_sha256": "51c84227023072a05ed3b4cae03662c7df80780551b6119c8af97301472642d4", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 279, "observable_limit": 5000, "observables_total": 279, "matched_observables": 0, "observables_checked": 279, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:01:34.871807+00:00", "session_id": "c1e69ddc-85b8-4193-a6be-6bca5518f9df", "techniques": [ { "url": "https://attack.mitre.org/techniques/T1105", "name": "Ingress Tool Transfer", "status": "catalog-context-not-validation-of-behavior", "attack_id": "T1105", "detection": "", "platforms": [ "ESXi", "Linux", "macOS", "Network Devices", "Windows" ], "data_sources": [ "WinEventLog:Sysmon", "auditd:SYSCALL", "iptables:LOG", "macos:endpointsecurity", "macos:unifiedlog", "esxi:hostd", "esxi:vmkernel", "NSM:Flow", "snmp:syslog" ], "catalog_version_id": 851, "detection_strategies": [ { "name": "Detect Ingress Tool Transfers via Behavioral Chain", "stix_id": "x-mitre-detection-strategy--67677c4c-5778-49eb-ae74-1920645b8554", "attack_id": "DET0060" } ], "detection_links_truncated": false } ], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "b92e780dc39ce7723d6ec8f29efdc3bd1a63f07184fbffcc7b8723ab3277df7d", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "058c1af6f71cde55e06a5ff1ac15ceb6974d302dcb74abe1bc455994ba1d18e4", "cross_case_correlations": [ { "shared_count": 23, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 50, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 34, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 6, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 17, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 18, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 13, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 19, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 23, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 22, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 20, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 3, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 9, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 12, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 17, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 23, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 22, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 13, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "058c1af6f71cde55e06a5ff1ac15ceb6974d302dcb74abe1bc455994ba1d18e4", "items": [ { "observable_id": "observable-352941c787870f49d152d39a", "type": "domain", "value": "a-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:09.908536+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.767952+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 8174, "display_filter": "frame.number == 8174", "timestamp_epoch": "1580346153.371264000" }, { "udp_stream": 74, "frame_number": 8175, "display_filter": "frame.number == 8175", "timestamp_epoch": "1580346153.383388000" }, { "tcp_stream": 88, "frame_number": 8179, "display_filter": "frame.number == 8179", "timestamp_epoch": "1580346153.397126000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:41.765244+00:00" }, { "observable_id": "observable-7b0922aa16931df601564830", "type": "domain", "value": "adservice.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.772483+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 8893, "display_filter": "frame.number == 8893", "timestamp_epoch": "1580346164.163758000" }, { "udp_stream": 83, "frame_number": 8899, "display_filter": "frame.number == 8899", "timestamp_epoch": "1580346164.189103000" }, { "tcp_stream": 100, "frame_number": 8903, "display_filter": "frame.number == 8903", "timestamp_epoch": "1580346164.206635000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:41.770101+00:00" }, { "observable_id": "observable-23532d2d30d7fd9503541fe3", "type": "domain", "value": "api.ipify.org", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:41.967931+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.962407+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1237, "display_filter": "frame.number == 1237", "timestamp_epoch": "1580345758.330226000" }, { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" }, { "tcp_stream": 56, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1580345758.403785000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:41.956746+00:00" }, { "observable_id": "observable-39198b4fd15e2ced82e4f397", "type": "domain", "value": "apis.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:52.412014+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.173284+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 8771, "display_filter": "frame.number == 8771", "timestamp_epoch": "1580346163.901003000" }, { "udp_stream": 81, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1580346163.926174000" }, { "tcp_stream": 98, "frame_number": 8776, "display_filter": "frame.number == 8776", "timestamp_epoch": "1580346163.942156000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.169828+00:00" }, { "observable_id": "observable-6a18d57aab2281a4bf8a0846", "type": "domain", "value": "assets.squarespace.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:39.809094+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:39.605355+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.603240+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 9965, "display_filter": "frame.number == 9965", "timestamp_epoch": "1580346175.977669000" }, { "udp_stream": 93, "frame_number": 9969, "display_filter": "frame.number == 9969", "timestamp_epoch": "1580346175.996891000" }, { "udp_stream": 104, "frame_number": 12898, "display_filter": "frame.number == 12898", "timestamp_epoch": "1580346260.299235000" }, { "udp_stream": 104, "frame_number": 12918, "display_filter": "frame.number == 12918", "timestamp_epoch": "1580346260.328782000" }, { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" }, { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" }, { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" }, { "tcp_stream": 111, "frame_number": 9999, "display_filter": "frame.number == 9999", "timestamp_epoch": "1580346176.012348000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:39.600891+00:00" }, { "observable_id": "observable-64c74ab1cb8ee8154d9b9000", "type": "domain", "value": "client.wns.windows.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:12.580326+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.180501+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1580345705.324217000" }, { "udp_stream": 28, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1580345705.530620000" }, { "udp_stream": 41, "frame_number": 3466, "display_filter": "frame.number == 3466", "timestamp_epoch": "1580345764.847758000" }, { "udp_stream": 41, "frame_number": 3467, "display_filter": "frame.number == 3467", "timestamp_epoch": "1580345764.848131000" }, { "tcp_stream": 47, "frame_number": 942, "display_filter": "frame.number == 942", "timestamp_epoch": "1580345705.576845000" }, { "tcp_stream": 62, "frame_number": 3471, "display_filter": "frame.number == 3471", "timestamp_epoch": "1580345764.885473000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.176693+00:00" }, { "observable_id": "observable-00e5184df3441f86bca4c1d3", "type": "domain", "value": "config.edge.skype.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:13.482784+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.186812+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 7946, "display_filter": "frame.number == 7946", "timestamp_epoch": "1580346136.075907000" }, { "udp_stream": 58, "frame_number": 7948, "display_filter": "frame.number == 7948", "timestamp_epoch": "1580346136.088326000" }, { "tcp_stream": 81, "frame_number": 7952, "display_filter": "frame.number == 7952", "timestamp_epoch": "1580346136.114901000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.183871+00:00" }, { "observable_id": "observable-d2fc95d2e48bb4a65704b026", "type": "domain", "value": "desktop-4c02emg.sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:46.435511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.433473+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 14, "frame_number": 478, "display_filter": "frame.number == 478", "timestamp_epoch": "1580345694.867230000" }, { "udp_stream": 14, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1580345694.867451000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:46.431389+00:00" }, { "observable_id": "observable-21b202d653f40d2ee5bccbdd", "type": "domain", "value": "dmd.metaservices.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:40.547460+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.543175+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 499, "display_filter": "frame.number == 499", "timestamp_epoch": "1580345695.381660000" }, { "udp_stream": 17, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1580345695.400755000" }, { "tcp_stream": 24, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1580345695.523568000" }, { "tcp_stream": 24, "frame_number": 531, "display_filter": "frame.number == 531", "timestamp_epoch": "1580345695.893444000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:40.537616+00:00" }, { "observable_id": "observable-554ac719a35c62a670b3f08b", "type": "domain", "value": "edge.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:17.653359+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.191287+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 8416, "display_filter": "frame.number == 8416", "timestamp_epoch": "1580346163.410134000" }, { "udp_stream": 80, "frame_number": 8440, "display_filter": "frame.number == 8440", "timestamp_epoch": "1580346163.429483000" }, { "tcp_stream": 97, "frame_number": 8591, "display_filter": "frame.number == 8591", "timestamp_epoch": "1580346163.451141000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.189108+00:00" }, { "observable_id": "observable-133e893c42eb06b16d76fb65", "type": "domain", "value": "ext-cust.squarespace.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01b5e544d48a633512931679", "type": "domain", "value": "fonts.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.818148+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.199488+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 9978, "display_filter": "frame.number == 9978", "timestamp_epoch": "1580346176.007568000" }, { "udp_stream": 95, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1580346176.008821000" }, { "tcp_stream": 113, "frame_number": 10016, "display_filter": "frame.number == 10016", "timestamp_epoch": "1580346176.022922000" }, { "tcp_stream": 113, "frame_number": 13471, "display_filter": "frame.number == 13471", "timestamp_epoch": "1580346262.041421000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.195677+00:00" }, { "observable_id": "observable-06b23c4cb5b85a0ba4f3641c", "type": "domain", "value": "fonts.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.206407+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 8359, "display_filter": "frame.number == 8359", "timestamp_epoch": "1580346163.335890000" }, { "udp_stream": 78, "frame_number": 8367, "display_filter": "frame.number == 8367", "timestamp_epoch": "1580346163.359843000" }, { "udp_stream": 105, "frame_number": 12901, "display_filter": "frame.number == 12901", "timestamp_epoch": "1580346260.303439000" }, { "udp_stream": 105, "frame_number": 12919, "display_filter": "frame.number == 12919", "timestamp_epoch": "1580346260.328844000" }, { "tcp_stream": 117, "frame_number": 11080, "display_filter": "frame.number == 11080", "timestamp_epoch": "1580346176.917041000" }, { "tcp_stream": 120, "frame_number": 11111, "display_filter": "frame.number == 11111", "timestamp_epoch": "1580346176.932931000" }, { "tcp_stream": 121, "frame_number": 11122, "display_filter": "frame.number == 11122", "timestamp_epoch": "1580346176.934102000" }, { "tcp_stream": 121, "frame_number": 13483, "display_filter": "frame.number == 13483", "timestamp_epoch": "1580346262.089124000" }, { "tcp_stream": 95, "frame_number": 8385, "display_filter": "frame.number == 8385", "timestamp_epoch": "1580346163.374824000" }, { "tcp_stream": 94, "frame_number": 8387, "display_filter": "frame.number == 8387", "timestamp_epoch": "1580346163.375214000" }, { "tcp_stream": 103, "frame_number": 9223, "display_filter": "frame.number == 9223", "timestamp_epoch": "1580346172.209981000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.203096+00:00" }, { "observable_id": "observable-8694a02741fa1c3a1ac29aa6", "type": "domain", "value": "fp.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:21.666722+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.211404+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 8086, "display_filter": "frame.number == 8086", "timestamp_epoch": "1580346150.978656000" }, { "udp_stream": 71, "frame_number": 8087, "display_filter": "frame.number == 8087", "timestamp_epoch": "1580346150.991621000" }, { "tcp_stream": 85, "frame_number": 8091, "display_filter": "frame.number == 8091", "timestamp_epoch": "1580346151.005528000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.209111+00:00" }, { "observable_id": "observable-1c2d9ad67374eb96a4245433", "type": "domain", "value": "gengrasjeepram.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:39.978203+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:39.813162+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.811289+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 1164, "display_filter": "frame.number == 1164", "timestamp_epoch": "1580345757.280076000" }, { "udp_stream": 35, "frame_number": 1165, "display_filter": "frame.number == 1165", "timestamp_epoch": "1580345757.512836000" }, { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:39.809129+00:00" }, { "observable_id": "observable-86a05cdaf868673b31338ced", "type": "domain", "value": "go.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:22.062012+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.739394+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 483, "display_filter": "frame.number == 483", "timestamp_epoch": "1580345695.240525000" }, { "udp_stream": 16, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1580345695.260860000" }, { "tcp_stream": 23, "frame_number": 492, "display_filter": "frame.number == 492", "timestamp_epoch": "1580345695.322080000" }, { "tcp_stream": 25, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1580345695.834804000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:40.735096+00:00" }, { "observable_id": "observable-efa36f1f7c5cc3a58b745c6a", "type": "domain", "value": "google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:42.217118+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.215424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 8214, "display_filter": "frame.number == 8214", "timestamp_epoch": "1580346162.701203000" }, { "udp_stream": 75, "frame_number": 8215, "display_filter": "frame.number == 8215", "timestamp_epoch": "1580346162.725232000" }, { "tcp_stream": 89, "frame_number": 8222, "display_filter": "frame.number == 8222", "timestamp_epoch": "1580346162.739566000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.213631+00:00" }, { "observable_id": "observable-01397b3867d0839f6aadf409", "type": "domain", "value": "googleads.g.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:42.522371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.519517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 84, "frame_number": 8923, "display_filter": "frame.number == 8923", "timestamp_epoch": "1580346164.281460000" }, { "udp_stream": 84, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1580346164.306160000" }, { "tcp_stream": 101, "frame_number": 8928, "display_filter": "frame.number == 8928", "timestamp_epoch": "1580346164.322115000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.516569+00:00" }, { "observable_id": "observable-f3095eefe32959dac62725ac", "type": "domain", "value": "googlehosted.l.googleusercontent.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1580346173.078164000" }, { "udp_stream": 87, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1580346174.305768000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f3b8a2f9ca371f44e72a60e3", "type": "domain", "value": "gstaticadssl.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 8367, "display_filter": "frame.number == 8367", "timestamp_epoch": "1580346163.359843000" }, { "udp_stream": 105, "frame_number": 12919, "display_filter": "frame.number == 12919", "timestamp_epoch": "1580346260.328844000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7d6eb84ac9550477ad33e80b", "type": "domain", "value": "images.squarespace-cdn.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:42.819393+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.817176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 10702, "display_filter": "frame.number == 10702", "timestamp_epoch": "1580346176.092083000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "tcp_stream": 118, "frame_number": 10750, "display_filter": "frame.number == 10750", "timestamp_epoch": "1580346176.136362000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.813946+00:00" }, { "observable_id": "observable-4e5bbd1931504fef83fa6f72", "type": "domain", "value": "khm0.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:42.995840+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.991517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 13183, "display_filter": "frame.number == 13183", "timestamp_epoch": "1580346261.486853000" }, { "udp_stream": 110, "frame_number": 13193, "display_filter": "frame.number == 13193", "timestamp_epoch": "1580346261.515653000" }, { "tcp_stream": 139, "frame_number": 13203, "display_filter": "frame.number == 13203", "timestamp_epoch": "1580346261.528788000" }, { "tcp_stream": 140, "frame_number": 13217, "display_filter": "frame.number == 13217", "timestamp_epoch": "1580346261.530661000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:42.984291+00:00" }, { "observable_id": "observable-fb83fe731f046b43ce6211b3", "type": "domain", "value": "khm1.googleapis.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:43.176742+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.172122+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 13184, "display_filter": "frame.number == 13184", "timestamp_epoch": "1580346261.487034000" }, { "udp_stream": 111, "frame_number": 13194, "display_filter": "frame.number == 13194", "timestamp_epoch": "1580346261.515711000" }, { "tcp_stream": 141, "frame_number": 13215, "display_filter": "frame.number == 13215", "timestamp_epoch": "1580346261.530511000" }, { "tcp_stream": 142, "frame_number": 13219, "display_filter": "frame.number == 13219", "timestamp_epoch": "1580346261.530786000" }, { "tcp_stream": 143, "frame_number": 13221, "display_filter": "frame.number == 13221", "timestamp_epoch": "1580346261.530932000" }, { "tcp_stream": 144, "frame_number": 13223, "display_filter": "frame.number == 13223", "timestamp_epoch": "1580346261.531130000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.166792+00:00" }, { "observable_id": "observable-788473d7dfaf17818c5318e0", "type": "domain", "value": "l-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:43.360814+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.358964+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 8144, "display_filter": "frame.number == 8144", "timestamp_epoch": "1580346153.261315000" }, { "udp_stream": 73, "frame_number": 8145, "display_filter": "frame.number == 8145", "timestamp_epoch": "1580346153.280341000" }, { "tcp_stream": 87, "frame_number": 8149, "display_filter": "frame.number == 8149", "timestamp_epoch": "1580346153.295097000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.354151+00:00" }, { "observable_id": "observable-34d721d2c56c9ba1294896bf", "type": "domain", "value": "lh4.googleusercontent.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:46.603849+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.601529+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 87, "frame_number": 9851, "display_filter": "frame.number == 9851", "timestamp_epoch": "1580346174.280018000" }, { "udp_stream": 87, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1580346174.305768000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:46.598666+00:00" }, { "observable_id": "observable-5c0e575fd3a488bd48274963", "type": "domain", "value": "lh5.googleusercontent.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:43.559615+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.557730+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 9313, "display_filter": "frame.number == 9313", "timestamp_epoch": "1580346173.052547000" }, { "udp_stream": 86, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1580346173.078164000" }, { "tcp_stream": 104, "frame_number": 9332, "display_filter": "frame.number == 9332", "timestamp_epoch": "1580346173.092854000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.554974+00:00" }, { "observable_id": "observable-ec12f03882f74e8f09d1c36d", "type": "domain", "value": "login.microsoftonline.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:26.312021+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.730453+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1122, "display_filter": "frame.number == 1122", "timestamp_epoch": "1580345751.490053000" }, { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" }, { "tcp_stream": 53, "frame_number": 1127, "display_filter": "frame.number == 1127", "timestamp_epoch": "1580345751.530306000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.727392+00:00" }, { "observable_id": "observable-16a6b2bc02188c890e1aae9e", "type": "domain", "value": "maps.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:46.765747+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.764082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 97, "frame_number": 11075, "display_filter": "frame.number == 11075", "timestamp_epoch": "1580346176.900362000" }, { "udp_stream": 97, "frame_number": 11088, "display_filter": "frame.number == 11088", "timestamp_epoch": "1580346176.923260000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:46.761980+00:00" }, { "observable_id": "observable-96e58356fa588495fd30b76a", "type": "domain", "value": "maps.googleapis.com", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-c3e36d091e5d2ec8be6957e1", "rule_id": "cleartext-tokenized-api", "frame_number": 12989 }, { "kind": "behavior", "finding_id": "finding-24258cf33df9c63f3da9f31c", "rule_id": "cleartext-tokenized-api", "frame_number": 13187 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13360 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13362 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13364 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13366 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13377 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13379 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13385 }, { "kind": "behavior", "finding_id": "finding-4ccbf4ba009b4882e4c367c4", "rule_id": "cleartext-tokenized-api", "frame_number": 13409 }, { "kind": "behavior", "finding_id": "finding-96ad3dbaa154e41ef3d6b17f", "rule_id": "cleartext-tokenized-api", "frame_number": 13477 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:36.866533+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:36.673212+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.669102+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "udp_stream": 108, "frame_number": 12971, "display_filter": "frame.number == 12971", "timestamp_epoch": "1580346261.170645000" }, { "udp_stream": 108, "frame_number": 12984, "display_filter": "frame.number == 12984", "timestamp_epoch": "1580346261.193361000" }, { "tcp_stream": 134, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1580346261.207430000" }, { "tcp_stream": 134, "frame_number": 13042, "display_filter": "frame.number == 13042", "timestamp_epoch": "1580346261.292989000" }, { "tcp_stream": 135, "frame_number": 13052, "display_filter": "frame.number == 13052", "timestamp_epoch": "1580346261.352193000" }, { "tcp_stream": 137, "frame_number": 13054, "display_filter": "frame.number == 13054", "timestamp_epoch": "1580346261.352375000" }, { "tcp_stream": 136, "frame_number": 13056, "display_filter": "frame.number == 13056", "timestamp_epoch": "1580346261.352557000" }, { "tcp_stream": 135, "frame_number": 13167, "display_filter": "frame.number == 13167", "timestamp_epoch": "1580346261.465995000" }, { "tcp_stream": 137, "frame_number": 13169, "display_filter": "frame.number == 13169", "timestamp_epoch": "1580346261.466132000" }, { "tcp_stream": 135, "frame_number": 13187, "display_filter": "frame.number == 13187", "timestamp_epoch": "1580346261.491507000" }, { "tcp_stream": 135, "frame_number": 13360, "display_filter": "frame.number == 13360", "timestamp_epoch": "1580346261.596304000" }, { "tcp_stream": 137, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1580346261.597334000" }, { "tcp_stream": 136, "frame_number": 13364, "display_filter": "frame.number == 13364", "timestamp_epoch": "1580346261.598688000" }, { "tcp_stream": 134, "frame_number": 13366, "display_filter": "frame.number == 13366", "timestamp_epoch": "1580346261.599495000" }, { "tcp_stream": 146, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1580346261.614212000" }, { "tcp_stream": 147, "frame_number": 13379, "display_filter": "frame.number == 13379", "timestamp_epoch": "1580346261.614438000" }, { "tcp_stream": 137, "frame_number": 13385, "display_filter": "frame.number == 13385", "timestamp_epoch": "1580346261.639565000" }, { "tcp_stream": 137, "frame_number": 13407, "display_filter": "frame.number == 13407", "timestamp_epoch": "1580346261.955338000" }, { "tcp_stream": 146, "frame_number": 13409, "display_filter": "frame.number == 13409", "timestamp_epoch": "1580346261.955975000" }, { "tcp_stream": 146, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1580346262.073117000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:36.664369+00:00" }, { "observable_id": "observable-d46adf105e38738bf6119668", "type": "domain", "value": "maps.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:43.738676+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.735704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 109, "frame_number": 13171, "display_filter": "frame.number == 13171", "timestamp_epoch": "1580346261.466624000" }, { "udp_stream": 109, "frame_number": 13185, "display_filter": "frame.number == 13185", "timestamp_epoch": "1580346261.489516000" }, { "tcp_stream": 138, "frame_number": 13191, "display_filter": "frame.number == 13191", "timestamp_epoch": "1580346261.504672000" }, { "tcp_stream": 138, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1580346261.557116000" }, { "tcp_stream": 145, "frame_number": 13353, "display_filter": "frame.number == 13353", "timestamp_epoch": "1580346261.578833000" }, { "tcp_stream": 145, "frame_number": 13474, "display_filter": "frame.number == 13474", "timestamp_epoch": "1580346262.061304000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.733152+00:00" }, { "observable_id": "observable-4345a35c4c943043d234c876", "type": "domain", "value": "nexusrules.officeapps.live.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:26.851269+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.908777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 7723, "display_filter": "frame.number == 7723", "timestamp_epoch": "1580345984.277983000" }, { "udp_stream": 47, "frame_number": 7724, "display_filter": "frame.number == 7724", "timestamp_epoch": "1580345984.336546000" }, { "tcp_stream": 71, "frame_number": 7728, "display_filter": "frame.number == 7728", "timestamp_epoch": "1580345984.463481000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.906827+00:00" }, { "observable_id": "observable-67b1f4b386858ac9c4d451d3", "type": "domain", "value": "novvslyn.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 63, "frame_number": 7995, "display_filter": "frame.number == 7995", "timestamp_epoch": "1580346140.079440000" }, { "udp_stream": 63, "frame_number": 7999, "display_filter": "frame.number == 7999", "timestamp_epoch": "1580346140.101371000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15e828ff0ea60cb787d553b1", "type": "domain", "value": "novvslyn.sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 60, "frame_number": 7990, "display_filter": "frame.number == 7990", "timestamp_epoch": "1580346140.078545000" }, { "udp_stream": 60, "frame_number": 7992, "display_filter": "frame.number == 7992", "timestamp_epoch": "1580346140.078961000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4df66ca748839ffe25780510", "type": "domain", "value": "ogs.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:43.914733+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.912867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 8791, "display_filter": "frame.number == 8791", "timestamp_epoch": "1580346163.992029000" }, { "udp_stream": 82, "frame_number": 8847, "display_filter": "frame.number == 8847", "timestamp_epoch": "1580346164.019463000" }, { "tcp_stream": 99, "frame_number": 8853, "display_filter": "frame.number == 8853", "timestamp_epoch": "1580346164.035709000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:43.910884+00:00" }, { "observable_id": "observable-30541647766e053dfc18d334", "type": "domain", "value": "p.typekit.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:44.093662+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.091734+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 100, "frame_number": 12029, "display_filter": "frame.number == 12029", "timestamp_epoch": "1580346177.160264000" }, { "udp_stream": 100, "frame_number": 12034, "display_filter": "frame.number == 12034", "timestamp_epoch": "1580346177.179770000" }, { "tcp_stream": 126, "frame_number": 12038, "display_filter": "frame.number == 12038", "timestamp_epoch": "1580346177.193732000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.089384+00:00" }, { "observable_id": "observable-0edfeca0148343e72aa3f587", "type": "domain", "value": "pagead46.l.doubleclick.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 8899, "display_filter": "frame.number == 8899", "timestamp_epoch": "1580346164.189103000" }, { "udp_stream": 84, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1580346164.306160000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0686ca97d56768d2ff79df19", "type": "domain", "value": "play.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:44.376266+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.374351+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 8969, "display_filter": "frame.number == 8969", "timestamp_epoch": "1580346164.921973000" }, { "udp_stream": 85, "frame_number": 8970, "display_filter": "frame.number == 8970", "timestamp_epoch": "1580346164.942489000" }, { "tcp_stream": 102, "frame_number": 8974, "display_filter": "frame.number == 8974", "timestamp_epoch": "1580346164.956726000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.371034+00:00" }, { "observable_id": "observable-8a68573d0c7b01baeea4ec07", "type": "domain", "value": "plus.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1580346163.926174000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15ed8f6d4512f367e967c1b9", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 7724, "display_filter": "frame.number == 7724", "timestamp_epoch": "1580345984.336546000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cab2b43ca9f0df5e5cb5082f", "type": "domain", "value": "prod.squarespace.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1147e13b1931b6c70c76844d", "type": "domain", "value": "pti.store.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:27.440552+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.549998+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 7671, "display_filter": "frame.number == 7671", "timestamp_epoch": "1580345870.794640000" }, { "udp_stream": 46, "frame_number": 7672, "display_filter": "frame.number == 7672", "timestamp_epoch": "1580345870.814698000" }, { "tcp_stream": 69, "frame_number": 7677, "display_filter": "frame.number == 7677", "timestamp_epoch": "1580345870.832298000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.547893+00:00" }, { "observable_id": "observable-d3534d05ba9c690dbdb1793c", "type": "domain", "value": "s-0001.s-msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 7948, "display_filter": "frame.number == 7948", "timestamp_epoch": "1580346136.088326000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-05eb2400b156211fca744171", "type": "domain", "value": "self.events.data.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:27.827868+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.553719+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 729, "display_filter": "frame.number == 729", "timestamp_epoch": "1580345703.914322000" }, { "udp_stream": 26, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1580345703.932605000" }, { "udp_stream": 40, "frame_number": 1327, "display_filter": "frame.number == 1327", "timestamp_epoch": "1580345761.053095000" }, { "udp_stream": 40, "frame_number": 1356, "display_filter": "frame.number == 1356", "timestamp_epoch": "1580345761.097005000" }, { "tcp_stream": 38, "frame_number": 800, "display_filter": "frame.number == 800", "timestamp_epoch": "1580345704.119816000" }, { "tcp_stream": 61, "frame_number": 1398, "display_filter": "frame.number == 1398", "timestamp_epoch": "1580345761.150625000" }, { "tcp_stream": 77, "frame_number": 7830, "display_filter": "frame.number == 7830", "timestamp_epoch": "1580346023.998910000" }, { "tcp_stream": 78, "frame_number": 7869, "display_filter": "frame.number == 7869", "timestamp_epoch": "1580346113.588301000" }, { "tcp_stream": 79, "frame_number": 7873, "display_filter": "frame.number == 7873", "timestamp_epoch": "1580346113.627817000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.551901+00:00" }, { "observable_id": "observable-ddbf4f92702e25954b47f672", "type": "domain", "value": "self.events.data.onecollector.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1580345703.932605000" }, { "udp_stream": 40, "frame_number": 1356, "display_filter": "frame.number == 1356", "timestamp_epoch": "1580345761.097005000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3615d8b38021f237e0e52de2", "type": "domain", "value": "sol-lightnet-dc.sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:46.923204+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.921430+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 13, "frame_number": 276, "display_filter": "frame.number == 276", "timestamp_epoch": "1580345693.606109000" }, { "udp_stream": 13, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1580345693.606441000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:46.919478+00:00" }, { "observable_id": "observable-a6ca1f1d93f10b9b782ced58", "type": "domain", "value": "sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:40.954079+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.952111+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 15, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1580345694.868990000" }, { "udp_stream": 15, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1580345694.870229000" }, { "udp_stream": 27, "frame_number": 763, "display_filter": "frame.number == 763", "timestamp_epoch": "1580345703.983963000" }, { "udp_stream": 27, "frame_number": 764, "display_filter": "frame.number == 764", "timestamp_epoch": "1580345703.984249000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:40.949772+00:00" }, { "observable_id": "observable-79b337409ebb033536cad04d", "type": "domain", "value": "squarespace.map.fastly.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d552d0c6b774e72f7a60e8a2", "type": "domain", "value": "srjnzgvklqxna.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 64, "frame_number": 7997, "display_filter": "frame.number == 7997", "timestamp_epoch": "1580346140.079778000" }, { "udp_stream": 64, "frame_number": 8000, "display_filter": "frame.number == 8000", "timestamp_epoch": "1580346140.101541000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ae4554bf83eb0105c9cc7f3d", "type": "domain", "value": "srjnzgvklqxna.sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 7991, "display_filter": "frame.number == 7991", "timestamp_epoch": "1580346140.078803000" }, { "udp_stream": 61, "frame_number": 7993, "display_filter": "frame.number == 7993", "timestamp_epoch": "1580346140.079215000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-42f0807d3163d31afc14e8a0", "type": "domain", "value": "ssl.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:44.559966+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.558035+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 8343, "display_filter": "frame.number == 8343", "timestamp_epoch": "1580346163.271673000" }, { "udp_stream": 77, "frame_number": 8346, "display_filter": "frame.number == 8346", "timestamp_epoch": "1580346163.292957000" }, { "tcp_stream": 93, "frame_number": 8353, "display_filter": "frame.number == 8353", "timestamp_epoch": "1580346163.306491000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.555846+00:00" }, { "observable_id": "observable-290b1f7330903804b038cb81", "type": "domain", "value": "star-mini.c10r.facebook.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 11079, "display_filter": "frame.number == 11079", "timestamp_epoch": "1580346176.916963000" }, { "udp_stream": 107, "frame_number": 12974, "display_filter": "frame.number == 12974", "timestamp_epoch": "1580346261.179938000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e7c194496ef70e806e6d2cc0", "type": "domain", "value": "static1.squarespace.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:44.719891+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.717924+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 9966, "display_filter": "frame.number == 9966", "timestamp_epoch": "1580346175.979322000" }, { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 103, "frame_number": 12892, "display_filter": "frame.number == 12892", "timestamp_epoch": "1580346260.272017000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" }, { "tcp_stream": 114, "frame_number": 10010, "display_filter": "frame.number == 10010", "timestamp_epoch": "1580346176.020125000" }, { "tcp_stream": 116, "frame_number": 10012, "display_filter": "frame.number == 10012", "timestamp_epoch": "1580346176.020274000" }, { "tcp_stream": 115, "frame_number": 10008, "display_filter": "frame.number == 10008", "timestamp_epoch": "1580346176.019853000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.715767+00:00" }, { "observable_id": "observable-b0fa697b7b212fc483ec6564", "type": "domain", "value": "t-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:44.897701+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.895703+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 8114, "display_filter": "frame.number == 8114", "timestamp_epoch": "1580346153.147280000" }, { "udp_stream": 72, "frame_number": 8115, "display_filter": "frame.number == 8115", "timestamp_epoch": "1580346153.165117000" }, { "tcp_stream": 86, "frame_number": 8119, "display_filter": "frame.number == 8119", "timestamp_epoch": "1580346153.179668000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:44.893359+00:00" }, { "observable_id": "observable-eeefbb5ba49b1ed721120871", "type": "domain", "value": "twereptale.com", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 1251 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7711 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7823 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7916 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 12855 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.048441+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:36.874138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.870741+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "udp_stream": 37, "frame_number": 1246, "display_filter": "frame.number == 1246", "timestamp_epoch": "1580345758.460647000" }, { "udp_stream": 37, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1580345758.668788000" }, { "udp_stream": 39, "frame_number": 1308, "display_filter": "frame.number == 1308", "timestamp_epoch": "1580345760.481660000" }, { "udp_stream": 39, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1580345760.482013000" }, { "tcp_stream": 57, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1580345758.838022000" }, { "tcp_stream": 59, "frame_number": 1315, "display_filter": "frame.number == 1315", "timestamp_epoch": "1580345760.647757000" }, { "tcp_stream": 63, "frame_number": 3586, "display_filter": "frame.number == 3586", "timestamp_epoch": "1580345765.163080000" }, { "tcp_stream": 70, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1580345885.104183000" }, { "tcp_stream": 76, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1580346005.497228000" }, { "tcp_stream": 80, "frame_number": 7916, "display_filter": "frame.number == 7916", "timestamp_epoch": "1580346125.870845000" }, { "tcp_stream": 127, "frame_number": 12855, "display_filter": "frame.number == 12855", "timestamp_epoch": "1580346246.270378000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:36.866599+00:00" }, { "observable_id": "observable-3f737f67991064896752f5e2", "type": "domain", "value": "use.typekit.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:45.087539+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.084961+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9964, "display_filter": "frame.number == 9964", "timestamp_epoch": "1580346175.976792000" }, { "udp_stream": 92, "frame_number": 9967, "display_filter": "frame.number == 9967", "timestamp_epoch": "1580346175.990586000" }, { "udp_stream": 102, "frame_number": 12891, "display_filter": "frame.number == 12891", "timestamp_epoch": "1580346260.269585000" }, { "udp_stream": 102, "frame_number": 12897, "display_filter": "frame.number == 12897", "timestamp_epoch": "1580346260.282579000" }, { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" }, { "tcp_stream": 119, "frame_number": 11116, "display_filter": "frame.number == 11116", "timestamp_epoch": "1580346176.933425000" }, { "tcp_stream": 122, "frame_number": 11119, "display_filter": "frame.number == 11119", "timestamp_epoch": "1580346176.933874000" }, { "tcp_stream": 123, "frame_number": 11125, "display_filter": "frame.number == 11125", "timestamp_epoch": "1580346176.934528000" }, { "tcp_stream": 124, "frame_number": 11131, "display_filter": "frame.number == 11131", "timestamp_epoch": "1580346176.936624000" }, { "tcp_stream": 125, "frame_number": 11135, "display_filter": "frame.number == 11135", "timestamp_epoch": "1580346176.937865000" }, { "tcp_stream": 130, "frame_number": 12916, "display_filter": "frame.number == 12916", "timestamp_epoch": "1580346260.316460000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:45.081094+00:00" }, { "observable_id": "observable-e5250f6ce9432fbc15cd3488", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 967, "display_filter": "frame.number == 967", "timestamp_epoch": "1580345706.619777000" }, { "udp_stream": 30, "frame_number": 968, "display_filter": "frame.number == 968", "timestamp_epoch": "1580345706.619934000" }, { "udp_stream": 45, "frame_number": 4577, "display_filter": "frame.number == 4577", "timestamp_epoch": "1580345766.627729000" }, { "udp_stream": 45, "frame_number": 4578, "display_filter": "frame.number == 4578", "timestamp_epoch": "1580345766.628153000" }, { "udp_stream": 51, "frame_number": 7922, "display_filter": "frame.number == 7922", "timestamp_epoch": "1580346133.532618000" }, { "udp_stream": 51, "frame_number": 7923, "display_filter": "frame.number == 7923", "timestamp_epoch": "1580346133.532959000" }, { "udp_stream": 56, "frame_number": 7938, "display_filter": "frame.number == 7938", "timestamp_epoch": "1580346135.068977000" }, { "udp_stream": 56, "frame_number": 7939, "display_filter": "frame.number == 7939", "timestamp_epoch": "1580346135.069615000" }, { "udp_stream": 89, "frame_number": 9922, "display_filter": "frame.number == 9922", "timestamp_epoch": "1580346175.657584000" }, { "udp_stream": 89, "frame_number": 9923, "display_filter": "frame.number == 9923", "timestamp_epoch": "1580346175.657775000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-41aff77a1cee2ecb75249680", "type": "domain", "value": "wpad.sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 965, "display_filter": "frame.number == 965", "timestamp_epoch": "1580345706.619144000" }, { "udp_stream": 29, "frame_number": 966, "display_filter": "frame.number == 966", "timestamp_epoch": "1580345706.619407000" }, { "udp_stream": 44, "frame_number": 4573, "display_filter": "frame.number == 4573", "timestamp_epoch": "1580345766.626268000" }, { "udp_stream": 44, "frame_number": 4575, "display_filter": "frame.number == 4575", "timestamp_epoch": "1580345766.626816000" }, { "udp_stream": 50, "frame_number": 7920, "display_filter": "frame.number == 7920", "timestamp_epoch": "1580346133.530307000" }, { "udp_stream": 50, "frame_number": 7921, "display_filter": "frame.number == 7921", "timestamp_epoch": "1580346133.530794000" }, { "udp_stream": 55, "frame_number": 7936, "display_filter": "frame.number == 7936", "timestamp_epoch": "1580346135.067261000" }, { "udp_stream": 55, "frame_number": 7937, "display_filter": "frame.number == 7937", "timestamp_epoch": "1580346135.067724000" }, { "udp_stream": 88, "frame_number": 9920, "display_filter": "frame.number == 9920", "timestamp_epoch": "1580346175.656865000" }, { "udp_stream": 88, "frame_number": 9921, "display_filter": "frame.number == 9921", "timestamp_epoch": "1580346175.657159000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cf05bedb57269b04cddc983c", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:28.166581+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.267533+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 969, "display_filter": "frame.number == 969", "timestamp_epoch": "1580345708.560332000" }, { "udp_stream": 31, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1580345708.579100000" }, { "tcp_stream": 48, "frame_number": 974, "display_filter": "frame.number == 974", "timestamp_epoch": "1580345708.685523000" }, { "tcp_stream": 84, "frame_number": 8061, "display_filter": "frame.number == 8061", "timestamp_epoch": "1580346149.625887000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:45.262687+00:00" }, { "observable_id": "observable-bedada1f096215d36c4fc9c7", "type": "domain", "value": "www.facebook.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 11076, "display_filter": "frame.number == 11076", "timestamp_epoch": "1580346176.900868000" }, { "udp_stream": 98, "frame_number": 11079, "display_filter": "frame.number == 11079", "timestamp_epoch": "1580346176.916963000" }, { "udp_stream": 107, "frame_number": 12966, "display_filter": "frame.number == 12966", "timestamp_epoch": "1580346261.150453000" }, { "udp_stream": 107, "frame_number": 12974, "display_filter": "frame.number == 12974", "timestamp_epoch": "1580346261.179938000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09c76cfa0c6060ddff741179", "type": "domain", "value": "www.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:45.279334+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.277180+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 8225, "display_filter": "frame.number == 8225", "timestamp_epoch": "1580346162.774103000" }, { "udp_stream": 76, "frame_number": 8226, "display_filter": "frame.number == 8226", "timestamp_epoch": "1580346162.796395000" }, { "udp_stream": 112, "frame_number": 13473, "display_filter": "frame.number == 13473", "timestamp_epoch": "1580346262.060835000" }, { "udp_stream": 112, "frame_number": 13479, "display_filter": "frame.number == 13479", "timestamp_epoch": "1580346262.083115000" }, { "tcp_stream": 91, "frame_number": 8231, "display_filter": "frame.number == 8231", "timestamp_epoch": "1580346162.810738000" }, { "tcp_stream": 91, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1580346175.652447000" }, { "tcp_stream": 92, "frame_number": 8237, "display_filter": "frame.number == 8237", "timestamp_epoch": "1580346162.859161000" } ], "roles": [ "dns-query", "http-host", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:45.272664+00:00" }, { "observable_id": "observable-952474312a7bed1e1bf8a1dd", "type": "domain", "value": "www.gstatic.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:45.870621+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.868705+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 8393, "display_filter": "frame.number == 8393", "timestamp_epoch": "1580346163.385566000" }, { "udp_stream": 79, "frame_number": 8410, "display_filter": "frame.number == 8410", "timestamp_epoch": "1580346163.408663000" }, { "tcp_stream": 96, "frame_number": 8433, "display_filter": "frame.number == 8433", "timestamp_epoch": "1580346163.421483000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:45.866398+00:00" }, { "observable_id": "observable-1ca8d09224f87c4c381b8458", "type": "domain", "value": "www.instagram.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 11140, "display_filter": "frame.number == 11140", "timestamp_epoch": "1580346176.940784000" }, { "udp_stream": 99, "frame_number": 11217, "display_filter": "frame.number == 11217", "timestamp_epoch": "1580346176.960653000" }, { "udp_stream": 106, "frame_number": 12965, "display_filter": "frame.number == 12965", "timestamp_epoch": "1580346261.149966000" }, { "udp_stream": 106, "frame_number": 12975, "display_filter": "frame.number == 12975", "timestamp_epoch": "1580346261.180031000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7f6ec386949af78b236e810f", "type": "domain", "value": "www.tippingpointhampstead.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:40.749592+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.745800+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9929, "display_filter": "frame.number == 9929", "timestamp_epoch": "1580346175.766263000" }, { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" }, { "tcp_stream": 106, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1580346175.871552000" }, { "tcp_stream": 106, "frame_number": 11070, "display_filter": "frame.number == 11070", "timestamp_epoch": "1580346176.888399000" }, { "tcp_stream": 107, "frame_number": 11073, "display_filter": "frame.number == 11073", "timestamp_epoch": "1580346176.893673000" }, { "tcp_stream": 128, "frame_number": 12904, "display_filter": "frame.number == 12904", "timestamp_epoch": "1580346260.307088000" }, { "tcp_stream": 129, "frame_number": 12912, "display_filter": "frame.number == 12912", "timestamp_epoch": "1580346260.315953000" }, { "tcp_stream": 128, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1580346260.376231000" }, { "tcp_stream": 128, "frame_number": 12957, "display_filter": "frame.number == 12957", "timestamp_epoch": "1580346261.126327000" }, { "tcp_stream": 129, "frame_number": 12960, "display_filter": "frame.number == 12960", "timestamp_epoch": "1580346261.127758000" }, { "tcp_stream": 132, "frame_number": 12962, "display_filter": "frame.number == 12962", "timestamp_epoch": "1580346261.128864000" }, { "tcp_stream": 133, "frame_number": 12979, "display_filter": "frame.number == 12979", "timestamp_epoch": "1580346261.183798000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:40.743035+00:00" }, { "observable_id": "observable-88909cb39ee56156b0d1544a", "type": "domain", "value": "www3.l.google.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 8847, "display_filter": "frame.number == 8847", "timestamp_epoch": "1580346164.019463000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ceeee973527d2d7733fd9fd4", "type": "domain", "value": "xolightfinance.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:46.218850+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.215861+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1255, "display_filter": "frame.number == 1255", "timestamp_epoch": "1580345759.048081000" }, { "udp_stream": 38, "frame_number": 1256, "display_filter": "frame.number == 1256", "timestamp_epoch": "1580345759.142249000" }, { "tcp_stream": 58, "frame_number": 1260, "display_filter": "frame.number == 1260", "timestamp_epoch": "1580345759.390149000" }, { "tcp_stream": 58, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1580345764.042624000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:46.212958+00:00" }, { "observable_id": "observable-d7d1bf41978ca2a6862503cf", "type": "domain", "value": "z-p42-instagram.c10r.facebook.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 11217, "display_filter": "frame.number == 11217", "timestamp_epoch": "1580346176.960653000" }, { "udp_stream": 106, "frame_number": 12975, "display_filter": "frame.number == 12975", "timestamp_epoch": "1580346261.180031000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fbec66ed5919fe95e199d558", "type": "domain", "value": "zpckjikzgjvck.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 65, "frame_number": 7998, "display_filter": "frame.number == 7998", "timestamp_epoch": "1580346140.080227000" }, { "udp_stream": 65, "frame_number": 8001, "display_filter": "frame.number == 8001", "timestamp_epoch": "1580346140.101886000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac0c3b9e5afb73d08023cb61", "type": "domain", "value": "zpckjikzgjvck.sol-lightnet.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 7994, "display_filter": "frame.number == 7994", "timestamp_epoch": "1580346140.079379000" }, { "udp_stream": 62, "frame_number": 7996, "display_filter": "frame.number == 7996", "timestamp_epoch": "1580346140.079639000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8ee0d03ad119d74baa94c227", "type": "ipv4", "value": "10.20.30.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38dfa6ac17a673f28a8c6b36", "type": "ipv4", "value": "10.20.30.2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 1, "frame_number": 4, "display_filter": "frame.number == 4", "timestamp_epoch": "1580345692.506101000" }, { "udp_stream": 2, "frame_number": 6, "display_filter": "frame.number == 6", "timestamp_epoch": "1580345692.612130000" }, { "udp_stream": 7, "frame_number": 158, "display_filter": "frame.number == 158", "timestamp_epoch": "1580345692.876703000" }, { "udp_stream": 9, "frame_number": 173, "display_filter": "frame.number == 173", "timestamp_epoch": "1580345693.006461000" }, { "udp_stream": 11, "frame_number": 186, "display_filter": "frame.number == 186", "timestamp_epoch": "1580345693.209304000" }, { "udp_stream": 13, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1580345693.606441000" }, { "udp_stream": 14, "frame_number": 479, "display_filter": "frame.number == 479", "timestamp_epoch": "1580345694.867451000" }, { "udp_stream": 18, "frame_number": 513, "display_filter": "frame.number == 513", "timestamp_epoch": "1580345695.800856000" }, { "udp_stream": 27, "frame_number": 764, "display_filter": "frame.number == 764", "timestamp_epoch": "1580345703.984249000" }, { "udp_stream": 33, "frame_number": 1146, "display_filter": "frame.number == 1146", "timestamp_epoch": "1580345753.345199000" }, { "udp_stream": 42, "frame_number": 3474, "display_filter": "frame.number == 3474", "timestamp_epoch": "1580345764.891800000" }, { "udp_stream": 48, "frame_number": 7746, "display_filter": "frame.number == 7746", "timestamp_epoch": "1580345993.866483000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-270ca3c3d1d6ae000bdb4731", "type": "ipv4", "value": "10.20.30.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 15, "frame_number": 480, "display_filter": "frame.number == 480", "timestamp_epoch": "1580345694.868990000" }, { "udp_stream": 15, "frame_number": 481, "display_filter": "frame.number == 481", "timestamp_epoch": "1580345694.870229000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-049b18adb98c0ac048b27ea6", "type": "ipv4", "value": "10.20.30.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ecd299567ebb59f58115c259", "type": "ipv4", "value": "104.81.85.107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:47.092435+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.090584+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 92, "frame_number": 9967, "display_filter": "frame.number == 9967", "timestamp_epoch": "1580346175.990586000" }, { "udp_stream": 100, "frame_number": 12034, "display_filter": "frame.number == 12034", "timestamp_epoch": "1580346177.179770000" }, { "udp_stream": 102, "frame_number": 12897, "display_filter": "frame.number == 12897", "timestamp_epoch": "1580346260.282579000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:47.088366+00:00" }, { "observable_id": "observable-744e3486e2420aee898b86df", "type": "ipv4", "value": "104.97.213.249", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:40.192698+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:39.986961+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.982408+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 93, "frame_number": 9969, "display_filter": "frame.number == 9969", "timestamp_epoch": "1580346175.996891000" }, { "udp_stream": 104, "frame_number": 12918, "display_filter": "frame.number == 12918", "timestamp_epoch": "1580346260.328782000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:39.978267+00:00" }, { "observable_id": "observable-0aa1b9be090cd409abad3b74", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1580345708.579100000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7e1909485ccc20c1f7193b9f", "type": "ipv4", "value": "13.107.246.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:29.646359+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.295825+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 46, "frame_number": 7672, "display_filter": "frame.number == 7672", "timestamp_epoch": "1580345870.814698000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:47.288253+00:00" }, { "observable_id": "observable-cd8c55c8f5b3884012339f99", "type": "ipv4", "value": "13.107.246.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:47.324282+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.315913+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 8115, "display_filter": "frame.number == 8115", "timestamp_epoch": "1580346153.165117000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:47.305436+00:00" }, { "observable_id": "observable-ff7e8ddfe83bd6ccb4942262", "type": "ipv4", "value": "13.107.3.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:29.865521+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.543648+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 7948, "display_filter": "frame.number == 7948", "timestamp_epoch": "1580346136.088326000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:47.538908+00:00" }, { "observable_id": "observable-81ed5555e35fd2147bb4410e", "type": "ipv4", "value": "13.107.42.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:47.558879+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.554568+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 8145, "display_filter": "frame.number == 8145", "timestamp_epoch": "1580346153.280341000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:47.549426+00:00" }, { "observable_id": "observable-06d42fa16cfa5e57be4e4d50", "type": "ipv4", "value": "13.107.6.158", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:47.872899+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.870138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 8440, "display_filter": "frame.number == 8440", "timestamp_epoch": "1580346163.429483000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:47.866754+00:00" }, { "observable_id": "observable-a3f1204fa60fc5b3292520fb", "type": "ipv4", "value": "148.66.137.40", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:48.065207+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.060493+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 38, "frame_number": 1256, "display_filter": "frame.number == 1256", "timestamp_epoch": "1580345759.142249000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:48.055318+00:00" }, { "observable_id": "observable-3d00114ac0d006e86ba38612", "type": "ipv4", "value": "151.101.0.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:48.263653+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.259079+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:48.253596+00:00" }, { "observable_id": "observable-8b92ad5746f9db98f59270e7", "type": "ipv4", "value": "151.101.128.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9910cff152f5c5e4006b7568", "type": "ipv4", "value": "151.101.192.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38ec2b7b8299e374448f4a8f", "type": "ipv4", "value": "151.101.64.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 94, "frame_number": 9980, "display_filter": "frame.number == 9980", "timestamp_epoch": "1580346176.008872000" }, { "udp_stream": 96, "frame_number": 10703, "display_filter": "frame.number == 10703", "timestamp_epoch": "1580346176.092439000" }, { "udp_stream": 103, "frame_number": 12899, "display_filter": "frame.number == 12899", "timestamp_epoch": "1580346260.300132000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-19204220adaea5f662f62fce", "type": "ipv4", "value": "172.217.1.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:48.470072+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.465510+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 8772, "display_filter": "frame.number == 8772", "timestamp_epoch": "1580346163.926174000" }, { "udp_stream": 82, "frame_number": 8847, "display_filter": "frame.number == 8847", "timestamp_epoch": "1580346164.019463000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:48.460783+00:00" }, { "observable_id": "observable-43a307028a1b1ca8c6f90509", "type": "ipv4", "value": "172.217.12.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:48.683879+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.677548+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 111, "frame_number": 13194, "display_filter": "frame.number == 13194", "timestamp_epoch": "1580346261.515711000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:48.672721+00:00" }, { "observable_id": "observable-5b49c466655b1c3b61bc7cc6", "type": "ipv4", "value": "172.217.14.163", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:48.919699+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.913459+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 8367, "display_filter": "frame.number == 8367", "timestamp_epoch": "1580346163.359843000" }, { "udp_stream": 105, "frame_number": 12919, "display_filter": "frame.number == 12919", "timestamp_epoch": "1580346260.328844000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:48.906170+00:00" }, { "observable_id": "observable-0f9f78bb64f0ed70b6674dd9", "type": "ipv4", "value": "172.217.14.170", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:49.149165+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.144584+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 95, "frame_number": 9979, "display_filter": "frame.number == 9979", "timestamp_epoch": "1580346176.008821000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:49.139514+00:00" }, { "observable_id": "observable-020af2550833ac697a16d4d0", "type": "ipv4", "value": "172.217.2.227", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:49.361309+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.355867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 109, "frame_number": 13185, "display_filter": "frame.number == 13185", "timestamp_epoch": "1580346261.489516000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:49.349493+00:00" }, { "observable_id": "observable-b7d82a3e75e44dbc7bde38f8", "type": "ipv4", "value": "172.217.2.238", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:49.649285+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.644138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 110, "frame_number": 13193, "display_filter": "frame.number == 13193", "timestamp_epoch": "1580346261.515653000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:49.639092+00:00" }, { "observable_id": "observable-31e041284026c53eb24cc367", "type": "ipv4", "value": "172.217.9.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:49.845795+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.843810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 86, "frame_number": 9319, "display_filter": "frame.number == 9319", "timestamp_epoch": "1580346173.078164000" }, { "udp_stream": 87, "frame_number": 9854, "display_filter": "frame.number == 9854", "timestamp_epoch": "1580346174.305768000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:49.841519+00:00" }, { "observable_id": "observable-d85ee97d407dd5e5a6294245", "type": "ipv4", "value": "172.217.9.170", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-c3e36d091e5d2ec8be6957e1", "rule_id": "cleartext-tokenized-api", "frame_number": 12989 }, { "kind": "behavior", "finding_id": "finding-24258cf33df9c63f3da9f31c", "rule_id": "cleartext-tokenized-api", "frame_number": 13187 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13360 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13362 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13364 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13366 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13377 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13379 }, { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13385 }, { "kind": "behavior", "finding_id": "finding-4ccbf4ba009b4882e4c367c4", "rule_id": "cleartext-tokenized-api", "frame_number": 13409 }, { "kind": "behavior", "finding_id": "finding-96ad3dbaa154e41ef3d6b17f", "rule_id": "cleartext-tokenized-api", "frame_number": 13477 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.353678+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.057543+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.053083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "udp_stream": 108, "frame_number": 12984, "display_filter": "frame.number == 12984", "timestamp_epoch": "1580346261.193361000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:37.048514+00:00" }, { "observable_id": "observable-72644bc6f0fc8e638d1d05a6", "type": "ipv4", "value": "172.217.9.3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:50.208679+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:50.206224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 79, "frame_number": 8410, "display_filter": "frame.number == 8410", "timestamp_epoch": "1580346163.408663000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:50.203460+00:00" }, { "observable_id": "observable-796f923911ec361a6c16fa82", "type": "ipv4", "value": "174.129.223.190", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3486dc4a7d3359fdd16df1a2", "type": "ipv4", "value": "184.73.165.106", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7cf4defbf67487e22933aa3", "type": "ipv4", "value": "184.73.201.169", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d8e29d357b86421daa5bbc90", "type": "ipv4", "value": "198.185.159.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:41.122371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.118750+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:41.115106+00:00" }, { "observable_id": "observable-27b241c4684df799ab52da1f", "type": "ipv4", "value": "198.185.159.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5709f9db91a39203df4fd615", "type": "ipv4", "value": "198.49.23.144", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4b9f0b687cd7fb2fb0be243", "type": "ipv4", "value": "198.49.23.145", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 91, "frame_number": 9941, "display_filter": "frame.number == 9941", "timestamp_epoch": "1580346175.824400000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ab480ac094bdf532aca0cd40", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 31, "frame_number": 970, "display_filter": "frame.number == 970", "timestamp_epoch": "1580345708.579100000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-59136881d4b4f0510e72b070", "type": "ipv4", "value": "204.79.197.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 8087, "display_filter": "frame.number == 8087", "timestamp_epoch": "1580346150.991621000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ced0feb55294244200c5aa86", "type": "ipv4", "value": "204.79.197.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 8175, "display_filter": "frame.number == 8175", "timestamp_epoch": "1580346153.383388000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15e2ffee8b3ffb9515de1dd4", "type": "ipv4", "value": "216.58.193.130", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 8899, "display_filter": "frame.number == 8899", "timestamp_epoch": "1580346164.189103000" }, { "udp_stream": 84, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1580346164.306160000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ad684541d152704ed0b3c81", "type": "ipv4", "value": "216.58.193.132", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 8226, "display_filter": "frame.number == 8226", "timestamp_epoch": "1580346162.796395000" }, { "udp_stream": 112, "frame_number": 13479, "display_filter": "frame.number == 13479", "timestamp_epoch": "1580346262.083115000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d41375769c0cd41ba75809d0", "type": "ipv4", "value": "216.58.194.131", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 8346, "display_filter": "frame.number == 8346", "timestamp_epoch": "1580346163.292957000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e0d18b6ffe9b78cf542a825b", "type": "ipv4", "value": "216.58.194.46", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 8215, "display_filter": "frame.number == 8215", "timestamp_epoch": "1580346162.725232000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-afc61aaf3dc62d73f1bfb875", "type": "ipv4", "value": "216.58.194.78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 85, "frame_number": 8970, "display_filter": "frame.number == 8970", "timestamp_epoch": "1580346164.942489000" }, { "udp_stream": 97, "frame_number": 11088, "display_filter": "frame.number == 11088", "timestamp_epoch": "1580346176.923260000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a1f036847f83c05c5fb9e90b", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-127eb3013b3be4349cb7900f", "type": "ipv4", "value": "224.0.0.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-92b9868137665d752a2041e2", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1d6d528468e8bb2eb0041901", "type": "ipv4", "value": "23.21.50.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2724719282a4422bfd32dd8a", "type": "ipv4", "value": "23.21.59.179", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-15d1be10a78425c8951f31a7", "type": "ipv4", "value": "23.51.186.146", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:41.358569+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.350902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 16, "frame_number": 484, "display_filter": "frame.number == 484", "timestamp_epoch": "1580345695.260860000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:41.345391+00:00" }, { "observable_id": "observable-ad04550930cb710d0c81631d", "type": "ipv4", "value": "239.255.255.250", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 7927, "display_filter": "frame.number == 7927", "timestamp_epoch": "1580346133.604864000" }, { "frame_number": 7934, "display_filter": "frame.number == 7934", "timestamp_epoch": "1580346134.620020000" }, { "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1580346135.620959000" }, { "frame_number": 7974, "display_filter": "frame.number == 7974", "timestamp_epoch": "1580346136.539734000" }, { "frame_number": 7976, "display_filter": "frame.number == 7976", "timestamp_epoch": "1580346136.545842000" }, { "frame_number": 7978, "display_filter": "frame.number == 7978", "timestamp_epoch": "1580346136.621248000" }, { "frame_number": 7979, "display_filter": "frame.number == 7979", "timestamp_epoch": "1580346136.725775000" }, { "frame_number": 7985, "display_filter": "frame.number == 7985", "timestamp_epoch": "1580346139.526402000" }, { "frame_number": 7986, "display_filter": "frame.number == 7986", "timestamp_epoch": "1580346139.543253000" }, { "frame_number": 7989, "display_filter": "frame.number == 7989", "timestamp_epoch": "1580346139.730927000" }, { "frame_number": 8043, "display_filter": "frame.number == 8043", "timestamp_epoch": "1580346142.542100000" }, { "frame_number": 8047, "display_filter": "frame.number == 8047", "timestamp_epoch": "1580346142.557724000" }, { "frame_number": 12867, "display_filter": "frame.number == 12867", "timestamp_epoch": "1580346253.474549000" }, { "frame_number": 12876, "display_filter": "frame.number == 12876", "timestamp_epoch": "1580346254.484734000" }, { "frame_number": 12879, "display_filter": "frame.number == 12879", "timestamp_epoch": "1580346255.484867000" }, { "frame_number": 12880, "display_filter": "frame.number == 12880", "timestamp_epoch": "1580346256.499874000" } ], "roles": [ "http-host", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-883ffbcddfe689831a77a683", "type": "ipv4", "value": "31.13.93.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 99, "frame_number": 11217, "display_filter": "frame.number == 11217", "timestamp_epoch": "1580346176.960653000" }, { "udp_stream": 106, "frame_number": 12975, "display_filter": "frame.number == 12975", "timestamp_epoch": "1580346261.180031000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-23c723131915f7cae90f0de8", "type": "ipv4", "value": "31.13.93.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 98, "frame_number": 11079, "display_filter": "frame.number == 11079", "timestamp_epoch": "1580346176.916963000" }, { "udp_stream": 107, "frame_number": 12974, "display_filter": "frame.number == 12974", "timestamp_epoch": "1580346261.179938000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8849a253195719fc37ef2afd", "type": "ipv4", "value": "40.126.0.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c6c2b7e412c21cd569c9be51", "type": "ipv4", "value": "40.126.0.67", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-914f309aadb979a8ac3063af", "type": "ipv4", "value": "40.126.0.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4a1de74363ab18fff415b827", "type": "ipv4", "value": "40.126.0.69", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-abbf043351133828ecd7ce44", "type": "ipv4", "value": "40.126.0.70", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-223d076ef4d6e0efe0c251d0", "type": "ipv4", "value": "40.126.0.72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-172e585a11baf4b56d2af8b2", "type": "ipv4", "value": "40.126.0.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-af18852879eeceffa6697aa9", "type": "ipv4", "value": "40.126.0.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 32, "frame_number": 1123, "display_filter": "frame.number == 1123", "timestamp_epoch": "1580345751.503989000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3841398f3d50c9d554ac4144", "type": "ipv4", "value": "40.67.249.61", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:41.566971+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.562822+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 17, "frame_number": 500, "display_filter": "frame.number == 500", "timestamp_epoch": "1580345695.400755000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:41.557021+00:00" }, { "observable_id": "observable-42464e03ae0ee709a86b8a00", "type": "ipv4", "value": "49.51.133.162", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:40.335098+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.333379+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 35, "frame_number": 1165, "display_filter": "frame.number == 1165", "timestamp_epoch": "1580345757.512836000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:40.331146+00:00" }, { "observable_id": "observable-1d02084e7a811c23b5d8daa5", "type": "ipv4", "value": "52.109.76.30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 47, "frame_number": 7724, "display_filter": "frame.number == 7724", "timestamp_epoch": "1580345984.336546000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-81e130a889156166695e08c7", "type": "ipv4", "value": "52.114.132.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 1356, "display_filter": "frame.number == 1356", "timestamp_epoch": "1580345761.097005000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-39ccf2e5a590e55915d67cce", "type": "ipv4", "value": "52.114.75.79", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 26, "frame_number": 730, "display_filter": "frame.number == 730", "timestamp_epoch": "1580345703.932605000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1bd6c0164e95636d95050593", "type": "ipv4", "value": "52.242.211.89", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 28, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1580345705.530620000" }, { "udp_stream": 41, "frame_number": 3467, "display_filter": "frame.number == 3467", "timestamp_epoch": "1580345764.848131000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-31e82a216779dddb27b5bae1", "type": "ipv4", "value": "54.235.203.7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-013285e41cd98b06b36fcbcd", "type": "ipv4", "value": "54.235.220.229", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a638064567ccc2015d0659ca", "type": "ipv4", "value": "54.243.147.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1580345758.355581000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-031640c390e2212650f453d1", "type": "ipv4", "value": "81.177.6.156", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 1251 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7711 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7823 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7916 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 12855 } ], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.660586+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.362379+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.357743+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "udp_stream": 37, "frame_number": 1247, "display_filter": "frame.number == 1247", "timestamp_epoch": "1580345758.668788000" }, { "udp_stream": 39, "frame_number": 1309, "display_filter": "frame.number == 1309", "timestamp_epoch": "1580345760.482013000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:37.353743+00:00" }, { "observable_id": "observable-9d521be134da3e72b59df7db", "type": "sha256", "value": "0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-63f84859a3406312adec83ca", "type": "sha256", "value": "02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eaacd15e41f91d6c1ca29b08", "type": "sha256", "value": "05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-69fb912ed988434ffb006473", "type": "sha256", "value": "064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1be9c0f3bce145ea2a10ff25", "type": "sha256", "value": "07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7a9411df725ba7981b23b319", "type": "sha256", "value": "0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c09361fb6437117f35c94cac", "type": "sha256", "value": "10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09ac6441fdb5713709bfba7d", "type": "sha256", "value": "126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-112487ec52123a06fa02de1c", "type": "sha256", "value": "1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0266156ea6ddc254c352f4be", "type": "sha256", "value": "2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c02586821f041a395f1a6adf", "type": "sha256", "value": "238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-82fbff5f782ef185c35a9620", "type": "sha256", "value": "277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-714f45dfa844cb188e7ee515", "type": "sha256", "value": "29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f7016c5b0654926a5cbde01c", "type": "sha256", "value": "2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.881451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:37.669786+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.665736+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:37.660650+00:00" }, { "observable_id": "observable-7d1953d4d07dcc82df1e4e6d", "type": "sha256", "value": "39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-de552a71f3d15f67679f4db1", "type": "sha256", "value": "3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-843928b623f06e5aae3fd9d7", "type": "sha256", "value": "3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a8a86e6b171129dc6af6c9f4", "type": "sha256", "value": "3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-16e757516b3480d66a910ff9", "type": "sha256", "value": "431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a5e8aec64a45d584b8ec5d8d", "type": "sha256", "value": "48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b263313321ce68c560b9727", "type": "sha256", "value": "48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ba5e367739284c4904191a3e", "type": "sha256", "value": "4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3c3351a534cdd79808b1bd0c", "type": "sha256", "value": "53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9d6f248cad461b3e49b8697f", "type": "sha256", "value": "55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6907491499439574413f60e5", "type": "sha256", "value": "58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-baecdce94f907f854bbf11db", "type": "sha256", "value": "5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-195aa655c7efc2b246844cca", "type": "sha256", "value": "5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9b251bc299224fd7cce02361", "type": "sha256", "value": "6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c43efb0ebc983217bcbe27a", "type": "sha256", "value": "6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-589952c6f2ae3283d591caea", "type": "sha256", "value": "6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cbf5ed147d2b38fdf9353ac3", "type": "sha256", "value": "6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a16335d022f719dee6878c71", "type": "sha256", "value": "6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-432c5d3c1a5191a0175b39ea", "type": "sha256", "value": "731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d77d0ecd5ed43335a522bea1", "type": "sha256", "value": "7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e50be9e49489cc0e57b66081", "type": "sha256", "value": "7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-284b73b8289bf703858daed4", "type": "sha256", "value": "74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-24cba99c76f55e6dc0417069", "type": "sha256", "value": "79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8a0f1fea0e01325b249d2870", "type": "sha256", "value": "801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-38e4baf0eb45a9f5788b23de", "type": "sha256", "value": "866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f316232c786e900541ed90f2", "type": "sha256", "value": "8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-540959b1b4d50eadb57c79fe", "type": "sha256", "value": "8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9ede59840bac1c9d6e24d908", "type": "sha256", "value": "909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8bfacdcd218ae40689c6ee81", "type": "sha256", "value": "93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b1c471a21c471c59150de718", "type": "sha256", "value": "97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d51dc7b9ecca62246fcada44", "type": "sha256", "value": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:38.519751+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:38.289018+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.281256+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:38.272392+00:00" }, { "observable_id": "observable-b5a87b20bc4af3e66a1554a2", "type": "sha256", "value": "999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9262860a21159fc0a9b0b407", "type": "sha256", "value": "9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45840d2f074d84582b0072fb", "type": "sha256", "value": "a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a8b6a456dcaed205c615a8f8", "type": "sha256", "value": "a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4d6e5bba0125f1aa2f23af5e", "type": "sha256", "value": "a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dacbd932fb79f09c9740c732", "type": "sha256", "value": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7544d358b0eafe514ff7e810", "type": "sha256", "value": "aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72382c14f5bec01dda7cdbad", "type": "sha256", "value": "b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-72a395fbcea73a3e403f2d50", "type": "sha256", "value": "b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5fe8175c429d2a000f733dae", "type": "sha256", "value": "c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-995a3003316fa535b188c81f", "type": "sha256", "value": "c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c9cd62e25629282e7a824ffb", "type": "sha256", "value": "c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-005ca455919f97b2d0c5fe79", "type": "sha256", "value": "c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c6bcb782844c3876d9d6fd56", "type": "sha256", "value": "d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-34b965f5592111595acc9a2d", "type": "sha256", "value": "e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2ece8a6eedaa842d5fb8882a", "type": "sha256", "value": "e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2c8e089a256a05f96ae56f5", "type": "sha256", "value": "ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5810ceb7ddcd661f963a09e2", "type": "sha256", "value": "ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-421b7eeff0d382936b264638", "type": "sha256", "value": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3e6117dca0094872e11fdefd", "type": "sha256", "value": "f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9ac5800bf07d5cf2d8784de3", "type": "sha256", "value": "f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:39.176173+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:38.918585+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.914185+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:38.909018+00:00" }, { "observable_id": "observable-f831446ad2c72392b2893ba4", "type": "sha256", "value": "f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d187c4e7c1bcf536ccea27b9", "type": "sha256", "value": "fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-fc13354084058fe97ecd7f72", "type": "sha256", "value": "fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-06887eb5bec2f55d7cbb84a3", "type": "sha256", "value": "fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c0c4500a2dfb08d7a1aeb649", "type": "url", "value": "http://239.255.255.250:1900*", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "frame_number": 7927, "display_filter": "frame.number == 7927", "timestamp_epoch": "1580346133.604864000" }, { "frame_number": 7934, "display_filter": "frame.number == 7934", "timestamp_epoch": "1580346134.620020000" }, { "frame_number": 7944, "display_filter": "frame.number == 7944", "timestamp_epoch": "1580346135.620959000" }, { "frame_number": 7974, "display_filter": "frame.number == 7974", "timestamp_epoch": "1580346136.539734000" }, { "frame_number": 7976, "display_filter": "frame.number == 7976", "timestamp_epoch": "1580346136.545842000" }, { "frame_number": 7978, "display_filter": "frame.number == 7978", "timestamp_epoch": "1580346136.621248000" }, { "frame_number": 7979, "display_filter": "frame.number == 7979", "timestamp_epoch": "1580346136.725775000" }, { "frame_number": 7985, "display_filter": "frame.number == 7985", "timestamp_epoch": "1580346139.526402000" }, { "frame_number": 7986, "display_filter": "frame.number == 7986", "timestamp_epoch": "1580346139.543253000" }, { "frame_number": 7989, "display_filter": "frame.number == 7989", "timestamp_epoch": "1580346139.730927000" }, { "frame_number": 8043, "display_filter": "frame.number == 8043", "timestamp_epoch": "1580346142.542100000" }, { "frame_number": 8047, "display_filter": "frame.number == 8047", "timestamp_epoch": "1580346142.557724000" }, { "frame_number": 12867, "display_filter": "frame.number == 12867", "timestamp_epoch": "1580346253.474549000" }, { "frame_number": 12876, "display_filter": "frame.number == 12876", "timestamp_epoch": "1580346254.484734000" }, { "frame_number": 12879, "display_filter": "frame.number == 12879", "timestamp_epoch": "1580346255.484867000" }, { "frame_number": 12880, "display_filter": "frame.number == 12880", "timestamp_epoch": "1580346256.499874000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-397d4cd1b0f27b35801c1eea", "type": "url", "value": "http://api.ipify.org/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 56, "frame_number": 1242, "display_filter": "frame.number == 1242", "timestamp_epoch": "1580345758.403785000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8cef4822b3408d106f86a52e", "type": "url", "value": "http://assets.squarespace.com/universal/scripts-compressed/commerce-181ca5d368ee93562112c-min.en-US.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 112, "frame_number": 9993, "display_filter": "frame.number == 9993", "timestamp_epoch": "1580346176.011929000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-2f7584ac351b5d915a3983b7", "type": "url", "value": "http://assets.squarespace.com/universal/scripts-compressed/common-be17db26807bce4867107-min.en-US.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 9991, "display_filter": "frame.number == 9991", "timestamp_epoch": "1580346176.011638000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cb648f4a1703a47a60523029", "type": "url", "value": "http://assets.squarespace.com/universal/scripts-compressed/performance-6c529d24ffaa4730ab163-min.en-US.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 110, "frame_number": 9995, "display_filter": "frame.number == 9995", "timestamp_epoch": "1580346176.012077000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-cd9c09580ebe685dc6284dd8", "type": "url", "value": "http://assets.squarespace.com/universal/styles-compressed/commerce-d5d1d165eb43a2fed99901e0e7b185a3-min.css", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 111, "frame_number": 9999, "display_filter": "frame.number == 9999", "timestamp_epoch": "1580346176.012348000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f58393f974d06fc32ca6d88b", "type": "url", "value": "http://dmd.metaservices.microsoft.com/metadata.svc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 24, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1580345695.523568000" }, { "tcp_stream": 24, "frame_number": 531, "display_filter": "frame.number == 531", "timestamp_epoch": "1580345695.893444000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c892d61ecb65083ff57b9878", "type": "url", "value": "http://fonts.googleapis.com/css?family=Lato:100,400,700i,700,400i", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 113, "frame_number": 10016, "display_filter": "frame.number == 10016", "timestamp_epoch": "1580346176.022922000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3bfec01145eb502c3c3676b1", "type": "url", "value": "http://fonts.googleapis.com/css?family=Roboto:300,400,500,700|Google+Sans", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 113, "frame_number": 13471, "display_filter": "frame.number == 13471", "timestamp_epoch": "1580346262.041421000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e9dbbffec9b9ee5fefb6b15a", "type": "url", "value": "http://fonts.gstatic.com/s/lato/v16/S6u8w4BMUTPHh30AXC-q.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 121, "frame_number": 11122, "display_filter": "frame.number == 11122", "timestamp_epoch": "1580346176.934102000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c8918524b4dccf608f2d5c57", "type": "url", "value": "http://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 120, "frame_number": 11111, "display_filter": "frame.number == 11111", "timestamp_epoch": "1580346176.932931000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-416705e38e9d91cef55722f8", "type": "url", "value": "http://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wXg.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 117, "frame_number": 11080, "display_filter": "frame.number == 11080", "timestamp_epoch": "1580346176.917041000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d10a566aa06663c5f9d07c84", "type": "url", "value": "http://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxK.woff2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 121, "frame_number": 13483, "display_filter": "frame.number == 13483", "timestamp_epoch": "1580346262.089124000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5ee11d7f0f03366ccc564a42", "type": "url", "value": "http://gengrasjeepram.com/sv.exe", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1580345757.655509000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-01f3d1be14a42be5b28bd0e1", "type": "url", "value": "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 23, "frame_number": 492, "display_filter": "frame.number == 492", "timestamp_epoch": "1580345695.322080000" }, { "tcp_stream": 25, "frame_number": 520, "display_filter": "frame.number == 520", "timestamp_epoch": "1580345695.834804000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b91a028e318b290c4a352225", "type": "url", "value": "http://google.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 89, "frame_number": 8222, "display_filter": "frame.number == 8222", "timestamp_epoch": "1580346162.739566000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-818499bfed2122aee67974c9", "type": "url", "value": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3317&z=13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 140, "frame_number": 13217, "display_filter": "frame.number == 13217", "timestamp_epoch": "1580346261.530661000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-111c7c2228fedd3af4315f4e", "type": "url", "value": "http://khm0.googleapis.com/kh?v=863&hl=en&x=2134&y=3318&z=13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 139, "frame_number": 13203, "display_filter": "frame.number == 13203", "timestamp_epoch": "1580346261.528788000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4ebe261c5a059af9955af99a", "type": "url", "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3317&z=13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 142, "frame_number": 13219, "display_filter": "frame.number == 13219", "timestamp_epoch": "1580346261.530786000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f88f1362dd03d3dff3272430", "type": "url", "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2133&y=3318&z=13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 141, "frame_number": 13215, "display_filter": "frame.number == 13215", "timestamp_epoch": "1580346261.530511000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c6ab188f7b8fac09057ff11", "type": "url", "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3317&z=13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 143, "frame_number": 13221, "display_filter": "frame.number == 13221", "timestamp_epoch": "1580346261.530932000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da91a80e98e43b1920f564db", "type": "url", "value": "http://khm1.googleapis.com/kh?v=863&hl=en&x=2135&y=3318&z=13", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 144, "frame_number": 13223, "display_filter": "frame.number == 13223", "timestamp_epoch": "1580346261.531130000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5b53b0b74e02537e55c4400f", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/common.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 134, "frame_number": 13042, "display_filter": "frame.number == 13042", "timestamp_epoch": "1580346261.292989000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-62239c4de827140359777851", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/controls.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 137, "frame_number": 13407, "display_filter": "frame.number == 13407", "timestamp_epoch": "1580346261.955338000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6be4ba5eb88eacf79f889347", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/map.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 137, "frame_number": 13054, "display_filter": "frame.number == 13054", "timestamp_epoch": "1580346261.352375000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-09302b77d38eb71860198b27", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/marker.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 136, "frame_number": 13056, "display_filter": "frame.number == 13056", "timestamp_epoch": "1580346261.352557000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b3f27b37fc292ddf9071cd92", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/onion.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 135, "frame_number": 13167, "display_filter": "frame.number == 13167", "timestamp_epoch": "1580346261.465995000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f33fa8b30ac0930caffdd394", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/stats.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 137, "frame_number": 13169, "display_filter": "frame.number == 13169", "timestamp_epoch": "1580346261.466132000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-95a55fb78253b4551234a006", "type": "url", "value": "http://maps.googleapis.com/maps-api-v3/api/js/38/11/util.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 135, "frame_number": 13052, "display_filter": "frame.number == 13052", "timestamp_epoch": "1580346261.352193000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-eddde6e5ec75a657f760bd12", "type": "url", "value": "http://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&4sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&callback=_xdc_._j494pk&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-4ccbf4ba009b4882e4c367c4", "rule_id": "cleartext-tokenized-api", "frame_number": 13409 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 146, "frame_number": 13409, "display_filter": "frame.number == 13409", "timestamp_epoch": "1580346261.955975000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6332f0dd29ac1493092e0454", "type": "url", "value": "http://maps.googleapis.com/maps/api/js/QuotaService.RecordEvent?1shttp%3A%2F%2Fwww.tippingpointhampstead.com%2Fcontact&3sAIzaSyCBTROq6LuvF_IE1r46-T4AeTSV-0d7my8&7s01czxn&10e1&callback=_xdc_._6jo8ba&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-96ad3dbaa154e41ef3d6b17f", "rule_id": "cleartext-tokenized-api", "frame_number": 13477 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 146, "frame_number": 13477, "display_filter": "frame.number == 13477", "timestamp_epoch": "1580346262.073117000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ac4a9fff9ae6d2db44e52817", "type": "url", "value": "http://maps.googleapis.com/maps/api/js/ViewportInfoService.GetViewportInfo?1m6&1m2&1d32.23667731043261&2d-86.317594744384&2m2&1d32.42014288719476&2d-86.04535550144658&2u13&4sen&5e3&6sm%40498000000&7b0&8e0&callback=_xdc_._1bnhms&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-24258cf33df9c63f3da9f31c", "rule_id": "cleartext-tokenized-api", "frame_number": 13187 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 135, "frame_number": 13187, "display_filter": "frame.number == 13187", "timestamp_epoch": "1580346261.491507000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dc4880e16938d7d9167fb159", "type": "url", "value": "http://maps.googleapis.com/maps/api/js?v=3&callback=GoogleMapsApiLoadCallback&key=[redacted-captured-api-key]&language=en®ion=US", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-c3e36d091e5d2ec8be6957e1", "rule_id": "cleartext-tokenized-api", "frame_number": 12989 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 134, "frame_number": 12989, "display_filter": "frame.number == 12989", "timestamp_epoch": "1580346261.207430000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-93f92af25fc73b633ad2d15e", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m4!1m3!1i13!2i2133!3i3317!1m4!1m3!1i13!2i2133!3i3318!1m4!1m3!1i13!2i2134!3i3317!1m4!1m3!1i13!2i2135!3i3317!1m4!1m3!1i13!2i2134!3i3318!1m4!1m3!1i13!2i2135!3i3318!2m3!1e0!2sm!3i498212558!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e3!12m1!5b1&callback=_xdc_._gj3smp&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13385 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 137, "frame_number": 13385, "display_filter": "frame.number == 13385", "timestamp_epoch": "1580346261.639565000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a0d4c6c6b08c11c41e29a807", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3317!4i256!2m3!1e0!2sm!3i498212510!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13364 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 136, "frame_number": 13364, "display_filter": "frame.number == 13364", "timestamp_epoch": "1580346261.598688000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bc463e71bce5341bfcdc9e25", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2133!3i3318!4i256!2m3!1e0!2sm!3i498211754!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13362 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 137, "frame_number": 13362, "display_filter": "frame.number == 13362", "timestamp_epoch": "1580346261.597334000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0503c207937dbddb12ca1f5e", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13366 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 134, "frame_number": 13366, "display_filter": "frame.number == 13366", "timestamp_epoch": "1580346261.599495000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8ebdee35f5a78e75118e6251", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2134!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13360 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 135, "frame_number": 13360, "display_filter": "frame.number == 13360", "timestamp_epoch": "1580346261.596304000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-84b607894491f59154e50589", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3317!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13377 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 146, "frame_number": 13377, "display_filter": "frame.number == 13377", "timestamp_epoch": "1580346261.614212000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6807d361175b5a3f8f34bb1c", "type": "url", "value": "http://maps.googleapis.com/maps/vt?pb=!1m5!1m4!1i13!2i2135!3i3318!4i256!2m3!1e0!2sm!3i498212534!3m17!2sen!3sUS!5e18!12m4!1e68!2m2!1sset!2sRoadmapSatellite!12m3!1e37!2m1!1ssmartmaps!12m4!1e26!2m2!1sstyles!2zcy50OjMzfHMuZTpsfHAudjpvZmYscC52Om9mZixzLmU6bHxwLnY6b2ZmLHMuZTpsfHAudjpvbg!4e0&key=[redacted-captured-api-key]&token=[redacted]", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-5d9f1d3604e2f2431a0af1c1", "rule_id": "cleartext-tokenized-api", "frame_number": 13379 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 147, "frame_number": 13379, "display_filter": "frame.number == 13379", "timestamp_epoch": "1580346261.614438000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-98013dabde1f9bb895191a24", "type": "url", "value": "http://maps.gstatic.com/mapfiles/api-3/images/google_white5.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 145, "frame_number": 13474, "display_filter": "frame.number == 13474", "timestamp_epoch": "1580346262.061304000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3372e69ee3708c32b200554d", "type": "url", "value": "http://maps.gstatic.com/mapfiles/api-3/images/spotlight-poi2.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 145, "frame_number": 13353, "display_filter": "frame.number == 13353", "timestamp_epoch": "1580346261.578833000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c65e26c6c24a9d1d4b624374", "type": "url", "value": "http://maps.gstatic.com/mapfiles/openhand_8_8.cur", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 138, "frame_number": 13191, "display_filter": "frame.number == 13191", "timestamp_epoch": "1580346261.504672000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ca8f1916066e907682793cc7", "type": "url", "value": "http://maps.gstatic.com/mapfiles/transparent.png", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 138, "frame_number": 13302, "display_filter": "frame.number == 13302", "timestamp_epoch": "1580346261.557116000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-44782dd76609b8b2d37b5ee8", "type": "url", "value": "http://static1.squarespace.com/static/531a38d5e4b06ab55728bbcd/t/535732bde4b0ff45f1eff4ee/1575563567328/?format=1500w", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 116, "frame_number": 10012, "display_filter": "frame.number == 10012", "timestamp_epoch": "1580346176.020274000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ec8a08db34366d2c624d9139", "type": "url", "value": "http://static1.squarespace.com/static/sitecss/531a38d5e4b06ab55728bbcd/38/507c1fdf84ae362b5e7be44e/5334545ce4b08088919902af/2144-05142015/1575562637332/site.css?&filterFeatures=false", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 114, "frame_number": 10010, "display_filter": "frame.number == 10010", "timestamp_epoch": "1580346176.020125000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7985bdca94eb1024408f1479", "type": "url", "value": "http://twereptale.com/4/forum.php", "classification": "suspicious", "ioc_candidate": true, "reasons": [ { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 1251 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7711 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7823 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 7916 }, { "kind": "behavior", "finding_id": "finding-4374d41956c0deaa7b0a7227", "rule_id": "repeated-http-posts", "frame_number": 12855 } ], "signals": [], "provider_conflict": false, "ioc_selection_note": "Candidate requires analyst validation", "evidence": [ { "tcp_stream": 57, "frame_number": 1251, "display_filter": "frame.number == 1251", "timestamp_epoch": "1580345758.838022000" }, { "tcp_stream": 70, "frame_number": 7711, "display_filter": "frame.number == 7711", "timestamp_epoch": "1580345885.104183000" }, { "tcp_stream": 76, "frame_number": 7823, "display_filter": "frame.number == 7823", "timestamp_epoch": "1580346005.497228000" }, { "tcp_stream": 80, "frame_number": 7916, "display_filter": "frame.number == 7916", "timestamp_epoch": "1580346125.870845000" }, { "tcp_stream": 127, "frame_number": 12855, "display_filter": "frame.number == 12855", "timestamp_epoch": "1580346246.270378000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7fd0e5c321e1064c075b69ae", "type": "url", "value": "http://twereptale.com/d2/about.php", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 63, "frame_number": 3586, "display_filter": "frame.number == 3586", "timestamp_epoch": "1580345765.163080000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a0ba914d6201af4d4fe67664", "type": "url", "value": "http://twereptale.com/mlu/forum.php", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 59, "frame_number": 1315, "display_filter": "frame.number == 1315", "timestamp_epoch": "1580345760.647757000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-33afca492ae11265ce0e7a11", "type": "url", "value": "http://use.typekit.net/ik/_EI2k3FZD-AQNejpHhGQB_XT_3h1pAhauHoqffY4lAqfe7CffFHN4UJLFRbh52jhWD9DwAID5ebuZQsKw2ZyjR9uFDJtjc4RZg7oMPG0ie83Se80Zagz-AoX-eBlSYFXZABqO1FUiABkZWF3jAF8OcFzdPUCdhFydeyzSabCie83Se80Zagz-AoX-eBlSYFXZABqOcFzdPUX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0jhNlOYiaikoX-Wg3-Ao1SeNTd1sGjAu3Sas8jAb0SaBujW48Sagyjh90jhNlJ6TliWF8dkuDdeBKH6qJE6vbMg6gJMJ7fbRC2UMMeMw6MKG4fVMVIMMjgkMfH6qJ_bvbMg6FJMJ7fbRU2UMMegI6MTMgx_fQob9.js", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 108, "frame_number": 9976, "display_filter": "frame.number == 9976", "timestamp_epoch": "1580346176.004846000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bac7b5716299dc964d46e47d", "type": "url", "value": "http://www.google.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 91, "frame_number": 8231, "display_filter": "frame.number == 8231", "timestamp_epoch": "1580346162.810738000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9c4572a8e16ea1f1647c2f12", "type": "url", "value": "http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwjjot2hkKrnAhUFXK0KHXoTBzIQFjAAegQIGRAD&url=http%3A%2F%2Fwww.tippingpointhampstead.com%2F&usg=AOvVaw0Ci4vnf6a5erEDWMGH8q6L", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 91, "frame_number": 9913, "display_filter": "frame.number == 9913", "timestamp_epoch": "1580346175.652447000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbb59665f8c5fe3189dc7f5a", "type": "url", "value": "http://www.tippingpointhampstead.com/", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 9949, "display_filter": "frame.number == 9949", "timestamp_epoch": "1580346175.871552000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-21d01a581f0978b8a3216753", "type": "url", "value": "http://www.tippingpointhampstead.com/api/1/performance/records", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 129, "frame_number": 12912, "display_filter": "frame.number == 12912", "timestamp_epoch": "1580346260.315953000" }, { "tcp_stream": 128, "frame_number": 12946, "display_filter": "frame.number == 12946", "timestamp_epoch": "1580346260.376231000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a976af9dc53d855804124e34", "type": "url", "value": "http://www.tippingpointhampstead.com/api/1/performance/settings", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 107, "frame_number": 11073, "display_filter": "frame.number == 11073", "timestamp_epoch": "1580346176.893673000" }, { "tcp_stream": 133, "frame_number": 12979, "display_filter": "frame.number == 12979", "timestamp_epoch": "1580346261.183798000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b2794fd0d9f5162ebecf869a", "type": "url", "value": "http://www.tippingpointhampstead.com/api/census/form-render", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 132, "frame_number": 12962, "display_filter": "frame.number == 12962", "timestamp_epoch": "1580346261.128864000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9ac79003e9dac9380464fe5a", "type": "url", "value": "http://www.tippingpointhampstead.com/api/census/RecordHit", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 106, "frame_number": 11070, "display_filter": "frame.number == 11070", "timestamp_epoch": "1580346176.888399000" }, { "tcp_stream": 128, "frame_number": 12957, "display_filter": "frame.number == 12957", "timestamp_epoch": "1580346261.126327000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-8686208170d18d4555537a2b", "type": "url", "value": "http://www.tippingpointhampstead.com/api/events/RecordEvent", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 129, "frame_number": 12960, "display_filter": "frame.number == 12960", "timestamp_epoch": "1580346261.127758000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f69610f91794cba00ec2d5de", "type": "url", "value": "http://www.tippingpointhampstead.com/contact", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 128, "frame_number": 12904, "display_filter": "frame.number == 12904", "timestamp_epoch": "1580346260.307088000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0c7194426c8d6feb30d48229", "type": "url", "value": "http://xolightfinance.com/bhola/images/1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 1260, "display_filter": "frame.number == 1260", "timestamp_epoch": "1580345759.390149000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-7da572e090eff6850ff68062", "type": "url", "value": "http://xolightfinance.com/bhola/images/2", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 58, "frame_number": 3430, "display_filter": "frame.number == 3430", "timestamp_epoch": "1580345764.042624000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 251, "suspicious": 16 }, "ioc_candidate_count": 16, "summary": "267 typed observations; 16 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-3486dc4a7d3359fdd16df1a2", "type": "ipv4", "value": "184.73.165.106", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ab480ac094bdf532aca0cd40", "type": "ipv4", "value": "204.79.197.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-59136881d4b4f0510e72b070", "type": "ipv4", "value": "204.79.197.222", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ced0feb55294244200c5aa86", "type": "ipv4", "value": "204.79.197.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15e2ffee8b3ffb9515de1dd4", "type": "ipv4", "value": "216.58.193.130", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ad684541d152704ed0b3c81", "type": "ipv4", "value": "216.58.193.132", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d41375769c0cd41ba75809d0", "type": "ipv4", "value": "216.58.194.131", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e0d18b6ffe9b78cf542a825b", "type": "ipv4", "value": "216.58.194.46", "priority": 45, "reasons": [ "http_request-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-afc61aaf3dc62d73f1bfb875", "type": "ipv4", "value": "216.58.194.78", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c6c2b7e412c21cd569c9be51", "type": "ipv4", "value": "40.126.0.67", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d02084e7a811c23b5d8daa5", "type": "ipv4", "value": "52.109.76.30", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-81e130a889156166695e08c7", "type": "ipv4", "value": "52.114.132.22", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39ccf2e5a590e55915d67cce", "type": "ipv4", "value": "52.114.75.79", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1bd6c0164e95636d95050593", "type": "ipv4", "value": "52.242.211.89", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d521be134da3e72b59df7db", "type": "sha256", "value": "0075891d354b2055896e306187b1bd4544c27707d9bc67a63cc13d2331c28828", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-63f84859a3406312adec83ca", "type": "sha256", "value": "02096b84ee030a111a83fee9fd1b8943c800a6ef234c0a70e066c795f6b6be77", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-eaacd15e41f91d6c1ca29b08", "type": "sha256", "value": "05fa064fe3a8a66e99fb6f98a533583140668e84636733679fdfcf80a79cdfa3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-69fb912ed988434ffb006473", "type": "sha256", "value": "064b16847c95bff48a0a772fb216f212ff0e0e3a1cb59fbe44981fadae27f1df", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1be9c0f3bce145ea2a10ff25", "type": "sha256", "value": "07adb854bc069f03dd274c399f1687039754ef25778bf34ddcd74fb8f2b673b1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7a9411df725ba7981b23b319", "type": "sha256", "value": "0baca961680cdf231953072b012dec0c8102fcb03a2a99886fa7d72e5f9f0942", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c09361fb6437117f35c94cac", "type": "sha256", "value": "10a86d31e872ce9e1bc2a01262b66c48ed42d9b9641102d469b202916cbe344b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09ac6441fdb5713709bfba7d", "type": "sha256", "value": "126b6bd6f6928ba1bc3604931dbedca160ef6ba5f3142ecdf2342c57868c367e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-112487ec52123a06fa02de1c", "type": "sha256", "value": "1c02298424d54cde127dd20c498af5ee2cee8bab3c26fa594102787e6e733015", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0266156ea6ddc254c352f4be", "type": "sha256", "value": "2178eedd5723a6ac22e94ec59bdcd99229c87f3623753f5e199678242f0e90de", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c02586821f041a395f1a6adf", "type": "sha256", "value": "238c7cf411310bcfb331c6483fd492be1aed72e0f715fdd3d5249a0078104b88", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-82fbff5f782ef185c35a9620", "type": "sha256", "value": "277219068eb4d64b6aefa816868b942249edb95b83642f435dd0c11449158149", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-714f45dfa844cb188e7ee515", "type": "sha256", "value": "29ea96a8d7a71f29ed3f06c046e5ff19779bfc357c1411c7246677c4cc27428d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d1953d4d07dcc82df1e4e6d", "type": "sha256", "value": "39489afffa2d6143352910c2a91cb690c11662d51104ff09a89a6ea9829c04c5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-de552a71f3d15f67679f4db1", "type": "sha256", "value": "3ef67f52f3a36fdf4608cae1e58d90c7efce488225c1468851b7cfd9fb015f75", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-843928b623f06e5aae3fd9d7", "type": "sha256", "value": "3f077f1d99bf23dfc22940a2a3da28dc36346b3546d81fa3f327a0c1f5cd5b50", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a8a86e6b171129dc6af6c9f4", "type": "sha256", "value": "3fd22bd00dc08d18e05de1cb26cb52c506e0a110b2dce681a17ddf5d18322795", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16e757516b3480d66a910ff9", "type": "sha256", "value": "431e38270d4f07982ee43c388402a36a6f28fd04e301805028c934f6d134734b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5e8aec64a45d584b8ec5d8d", "type": "sha256", "value": "48c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b263313321ce68c560b9727", "type": "sha256", "value": "48c9bec83dc9eb0ea7eae65d0c64f453f3ea41944a966cbcf185ba1162080a7f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ba5e367739284c4904191a3e", "type": "sha256", "value": "4bc307a9452fb85b6cbcd70d59b42da3ee25406916722aa330a237b48ec5e45b", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3c3351a534cdd79808b1bd0c", "type": "sha256", "value": "53039cd7d1b1c830ff94f24b908232e744b8818ba3d1e4e38e6b691aa0e8a67d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9d6f248cad461b3e49b8697f", "type": "sha256", "value": "55f8c6f5f729e26df1363fef295ba5bba5d727d5901dd96b1fc73ae5396472b9", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6907491499439574413f60e5", "type": "sha256", "value": "58fade025ae74b192de062f5ec35ef3befba6886a29b8d0d16d6d542931bae3e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-baecdce94f907f854bbf11db", "type": "sha256", "value": "5927d888fadbb0287a158994973157cd4d9c5def1f8d46da20fc50a9ef76e619", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-195aa655c7efc2b246844cca", "type": "sha256", "value": "5cf9bb89d77a4575f05460db58ccbbcf1b00bc1eac18d43055b43cd1f53466b3", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9b251bc299224fd7cce02361", "type": "sha256", "value": "6986312b7ad97bcc1361cbf409f928164c8bd8ca269f1df2ebbe02ede37cad09", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4c43efb0ebc983217bcbe27a", "type": "sha256", "value": "6ca0dfc7607a2aa47370a94192af54d360ed7464dddc1af885255fd0e902ff2d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-589952c6f2ae3283d591caea", "type": "sha256", "value": "6d44ff94a670e162d1e5232e1fc9367d1951365ff76674baedf6f4c07f26bb5c", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cbf5ed147d2b38fdf9353ac3", "type": "sha256", "value": "6d971119a046fb86eeec343e50c680c36a72eb2df85521c8f343dc9678924398", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a16335d022f719dee6878c71", "type": "sha256", "value": "6f15f74a22723b6561cdc8d201d02b7f9c34c842403c4bf24fa4812a21a1628f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-432c5d3c1a5191a0175b39ea", "type": "sha256", "value": "731ee124abef9539221c6f1718b38b7fef383d0ade6fd90e771007916f95c69d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d77d0ecd5ed43335a522bea1", "type": "sha256", "value": "7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e50be9e49489cc0e57b66081", "type": "sha256", "value": "7481292657bab713410217c380622df800fe272da244fe523a755ed770b39a55", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-284b73b8289bf703858daed4", "type": "sha256", "value": "74a5b78327681f5e978adc0d730386dbe9ef18ca1c908faaf52e00ee08bd4f16", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-24cba99c76f55e6dc0417069", "type": "sha256", "value": "79af534e3b7241b5a46da3b11bd1d43305f9956ce573c9c0f9bd4afd3d492d94", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8a0f1fea0e01325b249d2870", "type": "sha256", "value": "801e72b52aead5a8a02c5dc07935f2a65dfaff8c4d593cf3214a227ec114efb7", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38e4baf0eb45a9f5788b23de", "type": "sha256", "value": "866d7375dee8d76f8effde365d10193dc5aca836e66119046d9220bdd710ab72", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f316232c786e900541ed90f2", "type": "sha256", "value": "8cc5e723ec68805594af53fac1c07a64e007c331f3094294d14ca3138de17c36", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-540959b1b4d50eadb57c79fe", "type": "sha256", "value": "8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9ede59840bac1c9d6e24d908", "type": "sha256", "value": "909d8cbf9337d0e47718e1d8b0c383e04bc85da85aa23df9a21809fb159b795e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8bfacdcd218ae40689c6ee81", "type": "sha256", "value": "93c8c6b8839d1c214655df81003227c77a95413fa57f6c964f68e69a56d96fe6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b1c471a21c471c59150de718", "type": "sha256", "value": "97b19088ed444b16205ec7704c147ebc59e17408f6e52d2cdcc8c1d66a4c08e6", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b5a87b20bc4af3e66a1554a2", "type": "sha256", "value": "999be0212e360703844f04024bd28394975389d6df9ac8631fa7f1005fc8bbed", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9262860a21159fc0a9b0b407", "type": "sha256", "value": "9b2dc55ec3bef01d57aee7c9f79fec573821d52dc45d8e41c61295984d427a37", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-45840d2f074d84582b0072fb", "type": "sha256", "value": "a08c05888c48e52254ace245682ec865316c1fd293368f0c0a74d039935409fa", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a8b6a456dcaed205c615a8f8", "type": "sha256", "value": "a68b20dfa0112058a5bedcee072671ba23b37d4112ac55f8af8f41d2e3f8cd30", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4d6e5bba0125f1aa2f23af5e", "type": "sha256", "value": "a6d7e96386ce861dd78829a8036db57d2b4939c308c918929598e6658037c6ce", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dacbd932fb79f09c9740c732", "type": "sha256", "value": "aab262e37da41344ba7172dbf7eb0426a5c18d133461dac340f8f8caf20eeabd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7544d358b0eafe514ff7e810", "type": "sha256", "value": "aad226d05a429ba98c92d394e1b746f2702b5107ab43bfc864fc4834736595c0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72382c14f5bec01dda7cdbad", "type": "sha256", "value": "b3c910382ea00af2dd290ace91c8853f1d804520c50b0f6fb65a0aad0dff829e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72a395fbcea73a3e403f2d50", "type": "sha256", "value": "b9b370bbbae1088914c66e63975307d991ae480acfd724945d62459e154b2a00", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5fe8175c429d2a000f733dae", "type": "sha256", "value": "c0de8bc8bb4d5ce4583faa64b477ee04dd07324a0f2efe4a65ffe04c6fb1cfcd", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-995a3003316fa535b188c81f", "type": "sha256", "value": "c12c6da8f90c307dc10efc2b70329fdd09477e1ea7bf69a054dcd30000485443", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c9cd62e25629282e7a824ffb", "type": "sha256", "value": "c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-005ca455919f97b2d0c5fe79", "type": "sha256", "value": "c5903c3f01fa4871a8a4ba392b0a0f4446c343a1445d64e8d6121b01fb3d80f1", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c6bcb782844c3876d9d6fd56", "type": "sha256", "value": "d75b154c4b0c10b1c9d471d74f6cc0b39b4e385d4b408ca78e3adb63f192461e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34b965f5592111595acc9a2d", "type": "sha256", "value": "e2af53c55174145ba0c04e339ceb66978b8438bd1bb1c1aca446c5889c596ac5", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2ece8a6eedaa842d5fb8882a", "type": "sha256", "value": "e3733e8dcceab60940d28d618315fe136d8e1c3ec1d05ecea63628c3744e401f", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b2c8e089a256a05f96ae56f5", "type": "sha256", "value": "ee2ea041f9b9d898f3ff48c8b2d53fb36b19c12fdb485849517952469144e1cf", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5810ceb7ddcd661f963a09e2", "type": "sha256", "value": "ef477bed20ecfac3b2e8c63b58fbc42b2de97e5359a64a5985fb1d18dc9733db", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-421b7eeff0d382936b264638", "type": "sha256", "value": "f1ea07a1e51a389c8de07120ae5c2e432e9dd8f4fbd6f92489f185b0523a3fd4", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3e6117dca0094872e11fdefd", "type": "sha256", "value": "f7e4aae30ab2bda60bead5fd5a29a36685d768df007d3399d3047768babae200", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f831446ad2c72392b2893ba4", "type": "sha256", "value": "f8e421120a437352ec4f4f73f729b86795917ca1b36b28ff201b2e295ca6f627", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d187c4e7c1bcf536ccea27b9", "type": "sha256", "value": "fbf8b1c6dbb154db47080a91b71438e0d3b836738a66f606ff4c65c4d5db2a7d", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fc13354084058fe97ecd7f72", "type": "sha256", "value": "fdecfb1e6595d77b382bff3bcd09dcf1718f497766730f416f43b6536fe45774", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06887eb5bec2f55d7cbb84a3", "type": "sha256", "value": "fe67e12a6497f8518ef1673fd8cf5622871935ff85f204715e78b2009dd48588", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-67b1f4b386858ac9c4d451d3", "type": "domain", "value": "novvslyn.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15e828ff0ea60cb787d553b1", "type": "domain", "value": "novvslyn.sol-lightnet.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d552d0c6b774e72f7a60e8a2", "type": "domain", "value": "srjnzgvklqxna.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ae4554bf83eb0105c9cc7f3d", "type": "domain", "value": "srjnzgvklqxna.sol-lightnet.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e5250f6ce9432fbc15cd3488", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-41aff77a1cee2ecb75249680", "type": "domain", "value": "wpad.sol-lightnet.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bedada1f096215d36c4fc9c7", "type": "domain", "value": "www.facebook.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1ca8d09224f87c4c381b8458", "type": "domain", "value": "www.instagram.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fbec66ed5919fe95e199d558", "type": "domain", "value": "zpckjikzgjvck.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ac0c3b9e5afb73d08023cb61", "type": "domain", "value": "zpckjikzgjvck.sol-lightnet.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-133e893c42eb06b16d76fb65", "type": "domain", "value": "ext-cust.squarespace.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3095eefe32959dac62725ac", "type": "domain", "value": "googlehosted.l.googleusercontent.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f3b8a2f9ca371f44e72a60e3", "type": "domain", "value": "gstaticadssl.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0edfeca0148343e72aa3f587", "type": "domain", "value": "pagead46.l.doubleclick.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8a68573d0c7b01baeea4ec07", "type": "domain", "value": "plus.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15ed8f6d4512f367e967c1b9", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cab2b43ca9f0df5e5cb5082f", "type": "domain", "value": "prod.squarespace.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3534d05ba9c690dbdb1793c", "type": "domain", "value": "s-0001.s-msedge.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ddbf4f92702e25954b47f672", "type": "domain", "value": "self.events.data.onecollector.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-79b337409ebb033536cad04d", "type": "domain", "value": "squarespace.map.fastly.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-290b1f7330903804b038cb81", "type": "domain", "value": "star-mini.c10r.facebook.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-88909cb39ee56156b0d1544a", "type": "domain", "value": "www3.l.google.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d7d1bf41978ca2a6862503cf", "type": "domain", "value": "z-p42-instagram.c10r.facebook.com", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0aa1b9be090cd409abad3b74", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8b92ad5746f9db98f59270e7", "type": "ipv4", "value": "151.101.128.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9910cff152f5c5e4006b7568", "type": "ipv4", "value": "151.101.192.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-38ec2b7b8299e374448f4a8f", "type": "ipv4", "value": "151.101.64.238", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-796f923911ec361a6c16fa82", "type": "ipv4", "value": "174.129.223.190", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f7cf4defbf67487e22933aa3", "type": "ipv4", "value": "184.73.201.169", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-27b241c4684df799ab52da1f", "type": "ipv4", "value": "198.185.159.145", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5709f9db91a39203df4fd615", "type": "ipv4", "value": "198.49.23.144", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4b9f0b687cd7fb2fb0be243", "type": "ipv4", "value": "198.49.23.145", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1d6d528468e8bb2eb0041901", "type": "ipv4", "value": "23.21.50.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2724719282a4422bfd32dd8a", "type": "ipv4", "value": "23.21.59.179", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-883ffbcddfe689831a77a683", "type": "ipv4", "value": "31.13.93.174", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23c723131915f7cae90f0de8", "type": "ipv4", "value": "31.13.93.35", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8849a253195719fc37ef2afd", "type": "ipv4", "value": "40.126.0.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-914f309aadb979a8ac3063af", "type": "ipv4", "value": "40.126.0.68", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4a1de74363ab18fff415b827", "type": "ipv4", "value": "40.126.0.69", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-abbf043351133828ecd7ce44", "type": "ipv4", "value": "40.126.0.70", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-223d076ef4d6e0efe0c251d0", "type": "ipv4", "value": "40.126.0.72", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-172e585a11baf4b56d2af8b2", "type": "ipv4", "value": "40.126.0.73", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-af18852879eeceffa6697aa9", "type": "ipv4", "value": "40.126.0.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31e82a216779dddb27b5bae1", "type": "ipv4", "value": "54.235.203.7", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-013285e41cd98b06b36fcbcd", "type": "ipv4", "value": "54.235.220.229", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a638064567ccc2015d0659ca", "type": "ipv4", "value": "54.243.147.226", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-96e58356fa588495fd30b76a", "type": "domain", "value": "maps.googleapis.com", "priority": 100, "reasons": [ "dns-name-not-resolver-verdict", "existing-evidence-candidate", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-eeefbb5ba49b1ed721120871", "type": "domain", "value": "twereptale.com", "priority": 100, "reasons": [ "dns-name-not-resolver-verdict", "existing-evidence-candidate", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-d85ee97d407dd5e5a6294245", "type": "ipv4", "value": "172.217.9.170", "priority": 100, "reasons": [ "existing-evidence-candidate", "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-031640c390e2212650f453d1", "type": "ipv4", "value": "81.177.6.156", "priority": 100, "reasons": [ "existing-evidence-candidate", "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": true }, { "observable_id": "observable-f7016c5b0654926a5cbde01c", "type": "sha256", "value": "2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d51dc7b9ecca62246fcada44", "type": "sha256", "value": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9ac5800bf07d5cf2d8784de3", "type": "sha256", "value": "f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12", "priority": 95, "reasons": [ "recovered-script-like-text-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6a18d57aab2281a4bf8a0846", "type": "domain", "value": "assets.squarespace.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c2d9ad67374eb96a4245433", "type": "domain", "value": "gengrasjeepram.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-744e3486e2420aee898b86df", "type": "ipv4", "value": "104.97.213.249", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-42464e03ae0ee709a86b8a00", "type": "ipv4", "value": "49.51.133.162", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-21b202d653f40d2ee5bccbdd", "type": "domain", "value": "dmd.metaservices.microsoft.com", "priority": 61, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-86a05cdaf868673b31338ced", "type": "domain", "value": "go.microsoft.com", "priority": 61, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7f6ec386949af78b236e810f", "type": "domain", "value": "www.tippingpointhampstead.com", "priority": 61, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a6ca1f1d93f10b9b782ced58", "type": "domain", "value": "sol-lightnet.com", "priority": 60, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d8e29d357b86421daa5bbc90", "type": "ipv4", "value": "198.185.159.144", "priority": 60, "reasons": [ "http_request-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-15d1be10a78425c8951f31a7", "type": "ipv4", "value": "23.51.186.146", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3841398f3d50c9d554ac4144", "type": "ipv4", "value": "40.67.249.61", "priority": 60, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-352941c787870f49d152d39a", "type": "domain", "value": "a-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7b0922aa16931df601564830", "type": "domain", "value": "adservice.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-23532d2d30d7fd9503541fe3", "type": "domain", "value": "api.ipify.org", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-39198b4fd15e2ced82e4f397", "type": "domain", "value": "apis.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-64c74ab1cb8ee8154d9b9000", "type": "domain", "value": "client.wns.windows.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00e5184df3441f86bca4c1d3", "type": "domain", "value": "config.edge.skype.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-554ac719a35c62a670b3f08b", "type": "domain", "value": "edge.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01b5e544d48a633512931679", "type": "domain", "value": "fonts.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06b23c4cb5b85a0ba4f3641c", "type": "domain", "value": "fonts.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8694a02741fa1c3a1ac29aa6", "type": "domain", "value": "fp.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-efa36f1f7c5cc3a58b745c6a", "type": "domain", "value": "google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-01397b3867d0839f6aadf409", "type": "domain", "value": "googleads.g.doubleclick.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7d6eb84ac9550477ad33e80b", "type": "domain", "value": "images.squarespace-cdn.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e5bbd1931504fef83fa6f72", "type": "domain", "value": "khm0.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fb83fe731f046b43ce6211b3", "type": "domain", "value": "khm1.googleapis.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-788473d7dfaf17818c5318e0", "type": "domain", "value": "l-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5c0e575fd3a488bd48274963", "type": "domain", "value": "lh5.googleusercontent.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ec12f03882f74e8f09d1c36d", "type": "domain", "value": "login.microsoftonline.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d46adf105e38738bf6119668", "type": "domain", "value": "maps.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4345a35c4c943043d234c876", "type": "domain", "value": "nexusrules.officeapps.live.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4df66ca748839ffe25780510", "type": "domain", "value": "ogs.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-30541647766e053dfc18d334", "type": "domain", "value": "p.typekit.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0686ca97d56768d2ff79df19", "type": "domain", "value": "play.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1147e13b1931b6c70c76844d", "type": "domain", "value": "pti.store.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-05eb2400b156211fca744171", "type": "domain", "value": "self.events.data.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-42f0807d3163d31afc14e8a0", "type": "domain", "value": "ssl.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e7c194496ef70e806e6d2cc0", "type": "domain", "value": "static1.squarespace.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b0fa697b7b212fc483ec6564", "type": "domain", "value": "t-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3f737f67991064896752f5e2", "type": "domain", "value": "use.typekit.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cf05bedb57269b04cddc983c", "type": "domain", "value": "www.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-09c76cfa0c6060ddff741179", "type": "domain", "value": "www.google.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-952474312a7bed1e1bf8a1dd", "type": "domain", "value": "www.gstatic.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ceeee973527d2d7733fd9fd4", "type": "domain", "value": "xolightfinance.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d2fc95d2e48bb4a65704b026", "type": "domain", "value": "desktop-4c02emg.sol-lightnet.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-34d721d2c56c9ba1294896bf", "type": "domain", "value": "lh4.googleusercontent.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-16a6b2bc02188c890e1aae9e", "type": "domain", "value": "maps.google.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3615d8b38021f237e0e52de2", "type": "domain", "value": "sol-lightnet-dc.sol-lightnet.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ecd299567ebb59f58115c259", "type": "ipv4", "value": "104.81.85.107", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7e1909485ccc20c1f7193b9f", "type": "ipv4", "value": "13.107.246.10", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cd8c55c8f5b3884012339f99", "type": "ipv4", "value": "13.107.246.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ff7e8ddfe83bd6ccb4942262", "type": "ipv4", "value": "13.107.3.128", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-81ed5555e35fd2147bb4410e", "type": "ipv4", "value": "13.107.42.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-06d42fa16cfa5e57be4e4d50", "type": "ipv4", "value": "13.107.6.158", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a3f1204fa60fc5b3292520fb", "type": "ipv4", "value": "148.66.137.40", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3d00114ac0d006e86ba38612", "type": "ipv4", "value": "151.101.0.238", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-19204220adaea5f662f62fce", "type": "ipv4", "value": "172.217.1.238", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-43a307028a1b1ca8c6f90509", "type": "ipv4", "value": "172.217.12.46", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5b49c466655b1c3b61bc7cc6", "type": "ipv4", "value": "172.217.14.163", "priority": 45, "reasons": [ "http_request-peer", "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0f9f78bb64f0ed70b6674dd9", "type": "ipv4", "value": "172.217.14.170", "priority": 45, "reasons": [ "http_request-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-020af2550833ac697a16d4d0", "type": "ipv4", "value": "172.217.2.227", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b7d82a3e75e44dbc7bde38f8", "type": "ipv4", "value": "172.217.2.238", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-31e041284026c53eb24cc367", "type": "ipv4", "value": "172.217.9.1", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-72644bc6f0fc8e638d1d05a6", "type": "ipv4", "value": "172.217.9.3", "priority": 45, "reasons": [ "tls_client_hello-peer", "unclassified_tcp-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 198, "next_batch": [ "observable-3486dc4a7d3359fdd16df1a2", "observable-ab480ac094bdf532aca0cd40", "observable-59136881d4b4f0510e72b070", "observable-ced0feb55294244200c5aa86", "observable-15e2ffee8b3ffb9515de1dd4", "observable-2ad684541d152704ed0b3c81", "observable-d41375769c0cd41ba75809d0", "observable-e0d18b6ffe9b78cf542a825b", "observable-afc61aaf3dc62d73f1bfb875", "observable-c6c2b7e412c21cd569c9be51" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "6806d40abf2b793023cd0ff23445a8988aad07b2d83979daa3c4a9076988c5db" }, "enrichment": { "items": [ { "type": "ipv4", "value": "172.217.9.3", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:50.208679+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:50.206224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:50.203460+00:00", "observable_id": "observable-72644bc6f0fc8e638d1d05a6" }, { "type": "ipv4", "value": "172.217.9.1", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.845795+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.843810+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:49.841519+00:00", "observable_id": "observable-31e041284026c53eb24cc367" }, { "type": "ipv4", "value": "172.217.2.238", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.649285+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.644138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:49.639092+00:00", "observable_id": "observable-b7d82a3e75e44dbc7bde38f8" }, { "type": "ipv4", "value": "172.217.2.227", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.361309+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.355867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:49.349493+00:00", "observable_id": "observable-020af2550833ac697a16d4d0" }, { "type": "ipv4", "value": "172.217.14.170", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.149165+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:49.144584+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:49.139514+00:00", "observable_id": "observable-0f9f78bb64f0ed70b6674dd9" }, { "type": "ipv4", "value": "172.217.14.163", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.919699+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.913459+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:48.906170+00:00", "observable_id": "observable-5b49c466655b1c3b61bc7cc6" }, { "type": "ipv4", "value": "172.217.12.46", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.683879+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.677548+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:48.672721+00:00", "observable_id": "observable-43a307028a1b1ca8c6f90509" }, { "type": "ipv4", "value": "172.217.1.238", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.470072+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.465510+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:48.460783+00:00", "observable_id": "observable-19204220adaea5f662f62fce" }, { "type": "ipv4", "value": "151.101.0.238", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.263653+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.259079+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:48.253596+00:00", "observable_id": "observable-3d00114ac0d006e86ba38612" }, { "type": "ipv4", "value": "148.66.137.40", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.065207+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:48.060493+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:48.055318+00:00", "observable_id": "observable-a3f1204fa60fc5b3292520fb" }, { "type": "ipv4", "value": "13.107.6.158", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.872899+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.870138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:47.866754+00:00", "observable_id": "observable-06d42fa16cfa5e57be4e4d50" }, { "type": "ipv4", "value": "13.107.42.254", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.558879+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.554568+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:47.549426+00:00", "observable_id": "observable-81ed5555e35fd2147bb4410e" }, { "type": "ipv4", "value": "13.107.3.128", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:29.865521+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.543648+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:47.538908+00:00", "observable_id": "observable-ff7e8ddfe83bd6ccb4942262" }, { "type": "ipv4", "value": "13.107.246.254", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.324282+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.315913+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:47.305436+00:00", "observable_id": "observable-cd8c55c8f5b3884012339f99" }, { "type": "ipv4", "value": "13.107.246.10", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:29.646359+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.295825+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:47.288253+00:00", "observable_id": "observable-7e1909485ccc20c1f7193b9f" }, { "type": "ipv4", "value": "104.81.85.107", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.092435+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:47.090584+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:47.088366+00:00", "observable_id": "observable-ecd299567ebb59f58115c259" }, { "type": "domain", "value": "sol-lightnet-dc.sol-lightnet.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.923204+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.921430+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:46.919478+00:00", "observable_id": "observable-3615d8b38021f237e0e52de2" }, { "type": "domain", "value": "maps.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.765747+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.764082+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:46.761980+00:00", "observable_id": "observable-16a6b2bc02188c890e1aae9e" }, { "type": "domain", "value": "lh4.googleusercontent.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.603849+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.601529+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:46.598666+00:00", "observable_id": "observable-34d721d2c56c9ba1294896bf" }, { "type": "domain", "value": "desktop-4c02emg.sol-lightnet.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.435511+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.433473+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:46.431389+00:00", "observable_id": "observable-d2fc95d2e48bb4a65704b026" }, { "type": "domain", "value": "xolightfinance.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.218850+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:46.215861+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:46.212958+00:00", "observable_id": "observable-ceeee973527d2d7733fd9fd4" }, { "type": "domain", "value": "www.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.870621+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.868705+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:45.866398+00:00", "observable_id": "observable-952474312a7bed1e1bf8a1dd" }, { "type": "domain", "value": "www.google.com", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.279334+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "www.google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "www.google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.277180+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:45.272664+00:00", "observable_id": "observable-09c76cfa0c6060ddff741179" }, { "type": "domain", "value": "www.bing.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:28.166581+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.267533+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:45.262687+00:00", "observable_id": "observable-cf05bedb57269b04cddc983c" }, { "type": "domain", "value": "use.typekit.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.087539+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:45.084961+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:45.081094+00:00", "observable_id": "observable-3f737f67991064896752f5e2" }, { "type": "domain", "value": "t-ring.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.897701+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.895703+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.893359+00:00", "observable_id": "observable-b0fa697b7b212fc483ec6564" }, { "type": "domain", "value": "static1.squarespace.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.719891+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.717924+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.715767+00:00", "observable_id": "observable-e7c194496ef70e806e6d2cc0" }, { "type": "domain", "value": "ssl.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.559966+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.558035+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.555846+00:00", "observable_id": "observable-42f0807d3163d31afc14e8a0" }, { "type": "domain", "value": "self.events.data.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:27.827868+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.553719+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.551901+00:00", "observable_id": "observable-05eb2400b156211fca744171" }, { "type": "domain", "value": "pti.store.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:27.440552+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.549998+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.547893+00:00", "observable_id": "observable-1147e13b1931b6c70c76844d" }, { "type": "domain", "value": "play.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.376266+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.374351+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.371034+00:00", "observable_id": "observable-0686ca97d56768d2ff79df19" }, { "type": "domain", "value": "p.typekit.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.093662+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:44.091734+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:44.089384+00:00", "observable_id": "observable-30541647766e053dfc18d334" }, { "type": "domain", "value": "ogs.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.914733+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.912867+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.910884+00:00", "observable_id": "observable-4df66ca748839ffe25780510" }, { "type": "domain", "value": "nexusrules.officeapps.live.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:26.851269+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.908777+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.906827+00:00", "observable_id": "observable-4345a35c4c943043d234c876" }, { "type": "domain", "value": "maps.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.738676+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.735704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.733152+00:00", "observable_id": "observable-d46adf105e38738bf6119668" }, { "type": "domain", "value": "login.microsoftonline.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:26.312021+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.730453+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.727392+00:00", "observable_id": "observable-ec12f03882f74e8f09d1c36d" }, { "type": "domain", "value": "lh5.googleusercontent.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.559615+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.557730+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.554974+00:00", "observable_id": "observable-5c0e575fd3a488bd48274963" }, { "type": "domain", "value": "l-ring.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.360814+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.358964+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.354151+00:00", "observable_id": "observable-788473d7dfaf17818c5318e0" }, { "type": "domain", "value": "khm1.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.176742+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:43.172122+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:43.166792+00:00", "observable_id": "observable-fb83fe731f046b43ce6211b3" }, { "type": "domain", "value": "khm0.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.995840+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.991517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.984291+00:00", "observable_id": "observable-4e5bbd1931504fef83fa6f72" }, { "type": "domain", "value": "images.squarespace-cdn.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.819393+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.817176+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.813946+00:00", "observable_id": "observable-7d6eb84ac9550477ad33e80b" }, { "type": "domain", "value": "googleads.g.doubleclick.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.522371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.519517+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.516569+00:00", "observable_id": "observable-01397b3867d0839f6aadf409" }, { "type": "domain", "value": "google.com", "signals": [ { "basis": "No direct maliciousness evidence", "actors": [], "source": "threatfox", "status": "ok", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.217118+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [ { "tier": 1, "source": "google.com", "target": "meet.google.com-join.us", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.usercontent.google.com/download?id=1RsoI3BAuH3uMNc6wdwwamUtsJhL6hHiB&export=download&confirm=t&uuid=32ec83bf-6d8e-4069-ac04-2cc059ae19e5", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claudemacos", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/brewpage", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/version-0105", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/hiddenhub", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xnewbrenow", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mellerbrew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clodemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbreshamewmew", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/onemacx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clavdenbewvews", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-deskt-ver-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/deutchbremac", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-24", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/clau-ver-un-v25", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbrewmacboe", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/claumacxvsz", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/payforwin", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/xbiernlk", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newpayservices.com/cdx-biz-ver-un-v27", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/newappclaude.com/clau-ver-un-30", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1CjSD0JhJj42n2yygv_75tmpvl6Uqic4o", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1V1G5Jk8mfKArijX1082xQoM4b7l-DF4x", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://drive.google.com/uc?export=download&id=1HcFfTSeJ59rLIfby_DJTz0sLYvQV_a7T", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/mehrmarkenwerkstattheiligensta/home", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" }, { "tier": 1, "source": "google.com", "target": "https://sites.google.com/view/facturacion2026mx", "evidence": "threatfox field ioc", "target_type": "ioc", "evidence_source": "threatfox" } ], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.215424+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.213631+00:00", "observable_id": "observable-efa36f1f7c5cc3a58b745c6a" }, { "type": "domain", "value": "fp.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:21.666722+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.211404+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.209111+00:00", "observable_id": "observable-8694a02741fa1c3a1ac29aa6" }, { "type": "domain", "value": "fonts.gstatic.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.985832+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.206407+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.203096+00:00", "observable_id": "observable-06b23c4cb5b85a0ba4f3641c" }, { "type": "domain", "value": "fonts.googleapis.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:19.818148+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.199488+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.195677+00:00", "observable_id": "observable-01b5e544d48a633512931679" }, { "type": "domain", "value": "edge.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:17.653359+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.191287+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.189108+00:00", "observable_id": "observable-554ac719a35c62a670b3f08b" }, { "type": "domain", "value": "config.edge.skype.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:13.482784+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.186812+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.183871+00:00", "observable_id": "observable-00e5184df3441f86bca4c1d3" }, { "type": "domain", "value": "client.wns.windows.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:12.580326+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.180501+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.176693+00:00", "observable_id": "observable-64c74ab1cb8ee8154d9b9000" }, { "type": "domain", "value": "apis.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:52.412014+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:42.173284+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:42.169828+00:00", "observable_id": "observable-39198b4fd15e2ced82e4f397" }, { "type": "domain", "value": "api.ipify.org", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.967931+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.962407+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:41.956746+00:00", "observable_id": "observable-23532d2d30d7fd9503541fe3" }, { "type": "domain", "value": "adservice.google.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:49.436607+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.772483+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:41.770101+00:00", "observable_id": "observable-7b0922aa16931df601564830" }, { "type": "domain", "value": "a-ring.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:09.908536+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.767952+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:41.765244+00:00", "observable_id": "observable-352941c787870f49d152d39a" }, { "type": "ipv4", "value": "40.67.249.61", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.566971+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.562822+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:41.557021+00:00", "observable_id": "observable-3841398f3d50c9d554ac4144" }, { "type": "ipv4", "value": "23.51.186.146", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.358569+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.350902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:41.345391+00:00", "observable_id": "observable-15d1be10a78425c8951f31a7" }, { "type": "ipv4", "value": "198.185.159.144", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.122371+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:41.118750+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:41.115106+00:00", "observable_id": "observable-d8e29d357b86421daa5bbc90" }, { "type": "domain", "value": "sol-lightnet.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.954079+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.952111+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:40.949772+00:00", "observable_id": "observable-a6ca1f1d93f10b9b782ced58" }, { "type": "domain", "value": "www.tippingpointhampstead.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.749592+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.745800+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:40.743035+00:00", "observable_id": "observable-7f6ec386949af78b236e810f" }, { "type": "domain", "value": "go.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:22.062012+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.739394+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:40.735096+00:00", "observable_id": "observable-86a05cdaf868673b31338ced" }, { "type": "domain", "value": "dmd.metaservices.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.547460+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.543175+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:40.537616+00:00", "observable_id": "observable-21b202d653f40d2ee5bccbdd" }, { "type": "ipv4", "value": "49.51.133.162", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.335098+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.333379+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:40.331146+00:00", "observable_id": "observable-42464e03ae0ee709a86b8a00" }, { "type": "ipv4", "value": "104.97.213.249", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:40.192698+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.986961+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.982408+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:39.978267+00:00", "observable_id": "observable-744e3486e2420aee898b86df" }, { "type": "domain", "value": "gengrasjeepram.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.978203+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.813162+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.811289+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:39.809129+00:00", "observable_id": "observable-1c2d9ad67374eb96a4245433" }, { "type": "domain", "value": "assets.squarespace.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.809094+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.605355+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.603240+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:39.600891+00:00", "observable_id": "observable-6a18d57aab2281a4bf8a0846" }, { "type": "sha256", "value": "f882c69e09c6e7abccce9f4383d1c96fc4fdfed5a8dfdaebba34236e645c9d12", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:39.176173+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.918585+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.914185+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:38.909018+00:00", "observable_id": "observable-9ac5800bf07d5cf2d8784de3" }, { "type": "sha256", "value": "995cbbb422634d497d65e12454cd5832cf1b4422189d9ec06efa88ed56891cda", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.519751+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.289018+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:38.281256+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:38.272392+00:00", "observable_id": "observable-d51dc7b9ecca62246fcada44" }, { "type": "sha256", "value": "2b58aa744abd78b50ee8423d675fad7f8bac513556be94a98b8d9c98b379424b", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.881451+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.669786+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.665736+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:37.660650+00:00", "observable_id": "observable-f7016c5b0654926a5cbde01c" }, { "type": "ipv4", "value": "81.177.6.156", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.660586+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.362379+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.357743+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:37.353743+00:00", "observable_id": "observable-031640c390e2212650f453d1" }, { "type": "ipv4", "value": "172.217.9.170", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.353678+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.057543+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.053083+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:37.048514+00:00", "observable_id": "observable-d85ee97d407dd5e5a6294245" }, { "type": "domain", "value": "twereptale.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:37.048441+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.874138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.870741+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:36.866599+00:00", "observable_id": "observable-eeefbb5ba49b1ed721120871" }, { "type": "domain", "value": "maps.googleapis.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.866533+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.673212+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.669102+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:36.664369+00:00", "observable_id": "observable-96e58356fa588495fd30b76a" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-72644bc6f0fc8e638d1d05a6" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-72644bc6f0fc8e638d1d05a6" } ], "batch_targets": 1, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 71, "full_urls_disclosed": 0, "provider_lookups_started": 1 }, "updated_at": "2026-09-22T17:45:50.416576+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "682ddd00034d69c3a1b1a820dbe79a898659b79ed28f069a3dbc2beec4625174", "source_semantic_sha256": "058c1af6f71cde55e06a5ff1ac15ceb6974d302dcb74abe1bc455994ba1d18e4", "previous_snapshot_sha256": "5ad2412545d15761fc49d8c42af6b1e712567611d707b6631487f33c6e521e2e" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [ { "attack_id": "T1105", "name": "Ingress Tool Transfer", "tactic": "command-and-control", "confidence": 0.8, "evidence": "T1105 Ingress Tool Transfer", "review_status": "suggested", "evidence_start": 15025, "evidence_end": 15052, "evidence_source": "source-text", "llm_verified": true, "review_note": null, "reviewer": null, "reviewed_at": null } ], "apt_matches": [ { "group_attack_id": "G0123", "group_name": "Volatile Cedar", "similarity": 0.2, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0044", "group_name": "Winnti Group", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0130", "group_name": "Ajax Security Team", "similarity": 0.1667, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0136", "group_name": "IndigoZebra", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0133", "group_name": "Nomadic Octopus", "similarity": 0.1429, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G1013", "group_name": "Metador", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0107", "group_name": "Whitefly", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0066", "group_name": "Elderwood", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0075", "group_name": "Rancor", "similarity": 0.1111, "shared_count": 1, "shared_techniques": [ "T1105" ] }, { "group_attack_id": "G0120", "group_name": "Evilnum", "similarity": 0.0909, "shared_count": 1, "shared_techniques": [ "T1105" ] } ], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }