{ "analysis_id": "d9aa0de8-e06d-40b7-bffc-2e1af3c53ea0", "session_id": "04f135b9-8158-47a2-bfef-d6de028c53c4", "status": "completed", "filename": "2020-02-21-traffic-analysis-exercise.pcap", "source_sha256": "8b984eca8fb96799a9ad7ec5ee766937e640dc1afcad77101e5aeb0ba6be137d", "source_size_bytes": 7642342, "schema_version": "pcap-analysis-v1", "semantic_sha256": "6fc7d6e1a73357c382b6269858c45faf638a8c9f52816c64ae733c965cb7611b", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "summary": "Decoded 9698 packets across 40 IP endpoints and 223 transport flows. Observed 129 DNS events, 29 HTTP requests, 50 TLS ClientHello events, and 10 recovered file/message object(s). Deterministic rules produced 6 finding(s): 0 high, 0 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "report": "# AdversaryGraph Deterministic PCAP Analysis\n\nSource: 2020-02-21-traffic-analysis-exercise.pcap\nCapture SHA-256: `8b984eca8fb96799a9ad7ec5ee766937e640dc1afcad77101e5aeb0ba6be137d`\nSemantic result SHA-256: `6fc7d6e1a73357c382b6269858c45faf638a8c9f52816c64ae733c965cb7611b`\nAnalyzer manifest SHA-256: `1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0`\n\n## Executive summary\n\nDecoded 9698 packets across 40 IP endpoints and 223 transport flows. Observed 129 DNS events, 29 HTTP requests, 50 TLS ClientHello events, and 10 recovered file/message object(s). Deterministic rules produced 6 finding(s): 0 high, 0 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.\n\n## Capture facts\n\n- Packets: 9698\n- Duration: 1221.525013 seconds\n- Captured bytes: 7487150\n- Endpoints: 40\n- Flows: 223\n\n## Deterministic findings\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 231 / TCP stream 15, frame 233 / TCP stream 15, frame 235 / TCP stream 15, frame 245 / TCP stream 15, frame 247 / TCP stream 15.\n\nMetrics: `{\"destination\":\"172.17.8.8\",\"event_count\":38,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"172.17.8.174\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 22 / TCP stream 0, frame 80 / TCP stream 4, frame 177 / TCP stream 4, frame 182 / TCP stream 0, frame 199 / TCP stream 4.\n\nMetrics: `{\"destination\":\"172.17.8.8\",\"event_count\":86,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"172.17.8.174\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 810 / TCP stream 39, frame 812 / TCP stream 39, frame 814 / TCP stream 39, frame 816 / TCP stream 39, frame 818 / TCP stream 39.\n\nMetrics: `{\"destination\":\"172.17.8.8\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.17.8.174\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 232 / TCP stream 15, frame 234 / TCP stream 15, frame 236 / TCP stream 15, frame 246 / TCP stream 15, frame 248 / TCP stream 15.\n\nMetrics: `{\"destination\":\"172.17.8.174\",\"event_count\":38,\"operation_numbers\":[\"0\",\"1\",\"12\",\"30\"],\"protocol\":\"drsuapi\",\"source\":\"172.17.8.8\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 24 / TCP stream 0, frame 82 / TCP stream 4, frame 188 / TCP stream 4, frame 191 / TCP stream 0, frame 201 / TCP stream 4.\n\nMetrics: `{\"destination\":\"172.17.8.174\",\"event_count\":69,\"operation_numbers\":[\"\",\"1\",\"4,19,19,19,5\",\"4,5\",\"5\"],\"protocol\":\"ldap\",\"source\":\"172.17.8.8\"}`\n\n### LOW — Directory-service protocol activity\n\nDirectory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\n\nRule: `directory-service-activity@pcap-rules-v5`; confidence: 0.95; evidence: frame 811 / TCP stream 39, frame 813 / TCP stream 39, frame 815 / TCP stream 39, frame 817 / TCP stream 39, frame 819 / TCP stream 39.\n\nMetrics: `{\"destination\":\"172.17.8.174\",\"event_count\":15,\"operation_numbers\":[\"1\",\"16\",\"17\",\"3\",\"34\",\"36\",\"39\",\"5\",\"6\",\"64\",\"7\"],\"protocol\":\"samr\",\"source\":\"172.17.8.8\"}`\n\n## ATT&CK candidates\n\n- No deterministic ATT&CK candidates.\n\n## Identities\n\n- account: `desktop-tzmkhkc$`; client IPs: 172.17.8.174; frames: 87, 95, 108, 111, 112\n- account: `gabriella.ventura`; client IPs: 172.17.8.174; frames: 718, 726, 728, 740, 754\n- domain: `ONE-HOT-MESS`; client IPs: 172.17.8.174; frames: 796\n- full-name: `Gabriella Ventura`; client IPs: 172.17.8.174; frames: 825\n- hostname: `DESKTOP-5NCFYEU`; client IPs: 172.17.8.174; frames: 796\n- hostname: `DESKTOP-TZMKHKC`; client IPs: 172.17.8.174; frames: 1, 32, 314, 514, 515\n- netbios-group: `ONE-HOT-MESS`; client IPs: unbound subject; frames: 33, 513, 594, 600, 604\n\n## Observed network and file inventory — not an IOC verdict\n\n- domain: `2.tlu.dl.delivery.mp.microsoft.com`; roles: dns-query, http-host\n- domain: `7.tlu.dl.delivery.mp.microsoft.com`; roles: dns-query\n- domain: `a-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `blueflag.xyz`; roles: dns-query, http-host\n- domain: `c-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `client.wns.windows.com`; roles: dns-query, tls-sni\n- domain: `config.edge.skype.com`; roles: dns-query, tls-sni\n- domain: `cp601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `desktop-tzmkhkc.one-hot-mess.com`; roles: dns-query\n- domain: `dl.delivery.mp.microsoft.com`; roles: dns-query, http-host\n- domain: `dns.msftncsi.com`; roles: dns-query\n- domain: `fe2cr.update.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fe2cr.update.microsoft.com.akadns.net`; roles: dns-cname\n- domain: `fe3cr.delivery.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `fp-vp.azureedge.net`; roles: dns-query, tls-sni\n- domain: `fp.msedge.net`; roles: dns-query, tls-sni\n- domain: `geo.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `kv601.prod.do.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `login.microsoftonline.com`; roles: dns-query, tls-sni\n- domain: `mrodevicemgr.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `nexusrules.officeapps.live.com`; roles: dns-query, tls-sni\n- domain: `officecdn.microsoft.com`; roles: dns-query, tls-sni\n- domain: `one-hot-mess-dc.one-hot-mess.com`; roles: dns-query\n- domain: `one-hot-mess.com`; roles: dns-query\n- domain: `one-hot-mess.net`; roles: dns-query\n- domain: `ow1.res.office365.com`; roles: dns-query, tls-sni\n- domain: `prod.mrodevicemgr.live.com.akadns.net`; roles: dns-cname\n- domain: `prod.nexusrules.live.com.akadns.net`; roles: dns-cname\n- domain: `pti.store.microsoft.com`; roles: dns-query, tls-sni\n- domain: `s-0001.s-msedge.net`; roles: dns-cname\n- domain: `s-ring.msedge.net`; roles: dns-query, tls-sni\n- domain: `self.events.data.microsoft.com`; roles: dns-query, tls-sni\n- domain: `self.events.data.onecollector.akadns.net`; roles: dns-cname\n- domain: `tlu.dl.delivery.mp.microsoft.com`; roles: dns-query, http-host\n- domain: `tsfe.trafficmanager.net`; roles: dns-cname\n- domain: `tsfe.trafficshaping.dsp.mp.microsoft.com`; roles: dns-query, tls-sni\n- domain: `wpad.localdomain`; roles: dns-query\n- domain: `wpad.one-hot-mess.com`; roles: dns-query\n- domain: `www.bing.com`; roles: dns-query, tls-sni\n- ipv4: `0.0.0.0`; roles: network-endpoint\n- ipv4: `104.77.69.193`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.21.200`; roles: dns-answer\n- ipv4: `13.107.246.10`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.128`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.3.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.254`; roles: dns-answer, network-endpoint\n- ipv4: `13.107.4.50`; roles: dns-answer, network-endpoint\n- ipv4: `131.107.255.255`; roles: dns-answer\n- ipv4: `172.17.8.1`; roles: network-endpoint\n- ipv4: `172.17.8.174`; roles: dns-answer, network-endpoint\n- ipv4: `172.17.8.255`; roles: network-endpoint\n- ipv4: `172.17.8.8`; roles: dns-answer, network-endpoint\n- ipv4: `20.190.133.66`; roles: dns-answer\n- ipv4: `20.190.133.75`; roles: dns-answer\n- ipv4: `20.190.133.76`; roles: dns-answer\n- ipv4: `204.79.197.200`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.222`; roles: dns-answer, network-endpoint\n- ipv4: `204.79.197.254`; roles: dns-answer, network-endpoint\n- ipv4: `205.185.216.10`; roles: dns-answer, network-endpoint\n- ipv4: `205.185.216.42`; roles: dns-answer, network-endpoint\n- ipv4: `224.0.0.22`; roles: network-endpoint\n- ipv4: `224.0.0.251`; roles: network-endpoint\n- ipv4: `224.0.0.252`; roles: network-endpoint\n- ipv4: `23.1.236.100`; roles: dns-answer\n- ipv4: `23.1.236.107`; roles: dns-answer\n- ipv4: `23.1.236.114`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.236.125`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.236.74`; roles: dns-answer\n- ipv4: `23.1.236.75`; roles: dns-answer\n- ipv4: `23.1.236.85`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.236.92`; roles: dns-answer, network-endpoint\n- ipv4: `23.1.236.98`; roles: dns-answer\n- ipv4: `23.54.20.119`; roles: dns-answer, network-endpoint\n- ipv4: `23.54.20.139`; roles: dns-answer, network-endpoint\n- ipv4: `255.255.255.255`; roles: network-endpoint\n- ipv4: `40.126.5.100`; roles: dns-answer\n- ipv4: `40.126.5.35`; roles: dns-answer, network-endpoint\n- ipv4: `40.126.5.37`; roles: dns-answer\n- ipv4: `40.126.5.98`; roles: dns-answer\n- ipv4: `40.126.5.99`; roles: dns-answer\n- ipv4: `40.69.216.73`; roles: dns-answer, network-endpoint\n- ipv4: `40.91.116.226`; roles: dns-answer, network-endpoint\n- ipv4: `40.91.120.196`; roles: dns-answer\n- ipv4: `49.51.172.56`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.124.20`; roles: dns-answer, network-endpoint\n- ipv4: `52.109.2.55`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.128.9`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.132.22`; roles: dns-answer, network-endpoint\n- ipv4: `52.114.76.34`; roles: dns-answer, network-endpoint\n- ipv4: `52.159.17.76`; roles: dns-answer, network-endpoint\n- ipv4: `52.230.222.68`; roles: dns-answer, network-endpoint\n- ipv4: `64.4.54.18`; roles: dns-answer, network-endpoint\n- ipv4: `72.21.81.200`; roles: dns-answer, network-endpoint\n- ipv4: `91.211.88.122`; roles: network-endpoint\n- ja3: `28a2c9bd18a11de089ef85a160da29e4`; roles: tls-client-fingerprint\n- ja3: `37f463bf4616ecd445d4a1937da06e19`; roles: tls-client-fingerprint\n- ja3: `3b5074b1b5d032e5620f69f9f700ff0e`; roles: tls-client-fingerprint\n- ja3: `51c64c77e60f3980eea90869b68c58a8`; roles: tls-client-fingerprint\n- ja3: `9e10692f1b7f78228b2d4e424db3a98c`; roles: tls-client-fingerprint\n- ja3: `a0e9f5d64349fb13191bc781f81f42e1`; roles: tls-client-fingerprint\n- sha256: `03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066`; roles: exported-object\n- sha256: `166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e`; roles: exported-object\n- sha256: `647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78`; roles: exported-object\n- sha256: `6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc`; roles: exported-object\n- sha256: `7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48`; roles: exported-object\n- sha256: `9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86`; roles: exported-object\n- sha256: `a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961`; roles: exported-object\n- sha256: `bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0`; roles: exported-object\n- sha256: `f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513`; roles: exported-object\n- sha256: `fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25`; roles: exported-object\n- url: `http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d`; roles: http-request\n- url: `http://blueflag.xyz/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin`; roles: http-request\n- url: `http://dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash`; roles: http-request\n- url: `http://dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash`; roles: http-request\n- url: `http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash`; roles: http-request\n- url: `http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d`; roles: http-request\n- url: `http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d`; roles: http-request\n- user_agent: `Microsoft-Delivery-Optimization/10.0`; roles: http-client\n- user_agent: `Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)`; roles: http-client\n- exported object `ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d(2)`; SHA-256 `9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86`; size 629753 bytes\n SHA-1: `2feb83b309c1433581e9c8057a1a6ee06905c079`; MD5: `1fbd6e0a138ad489de433b9bda2970d5`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7398,\"response_frame\":8133,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":125,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d\"}]`.\n Static content: `{\"content_kind\":\"zip\",\"features\":[],\"inspected_bytes\":262144,\"inspection_truncated\":true,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":null}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `yrkbdmt.bin`; SHA-256 `03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066`; size 208896 bytes\n SHA-1: `5c3353be0c746f65ff1bb04bd442a956fb3a2c00`; MD5: `64aabb8c0ca6245f28dc0d7936208706`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":1340,\"response_frame\":1566,\"server_ip\":\"49.51.172.56\",\"status_code\":\"200\",\"tcp_stream\":60,\"url\":\"http://blueflag.xyz/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin\"}]`.\n Static content: `{\"content_kind\":\"pe\",\"features\":[],\"inspected_bytes\":208896,\"inspection_truncated\":false,\"interpretation\":\"Static content only; not proof of execution, intent, or malware family\",\"pe_kind\":\"executable\"}`. Not execution proof.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":208896,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d(2)`; SHA-256 `bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0`; size 791389 bytes\n SHA-1: `cf437ba0d4484a2edc7988b5e061485f42d43692`; MD5: `efebf1ede6670adf677cfa52a6a3b24f`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5894,\"response_frame\":7394,\"server_ip\":\"205.185.216.10\",\"status_code\":\"206\",\"tcp_stream\":120,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d(2)`; SHA-256 `647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78`; size 659511 bytes\n SHA-1: `2f4bb847fdefc74c10c6b2940a9cb5ef87a20d86`; MD5: `1c6ac712e341211921fad4a33f4175c3`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7969,\"response_frame\":8906,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":128,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `0092fb1c-d27f-429c-acdd-29b392ed3d33%3fP1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d(2)`; SHA-256 `6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc`; size 519620 bytes\n SHA-1: `3a9d42bca9b113a48bdafc938e32260588928d2f`; MD5: `dfc0902938b6ec9c616dc6d3203d2f01`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5896,\"response_frame\":6653,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":117,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":262144,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":true}`; do not infer the destination without an exact transfer binding.\n- exported object `pieceshash(2)`; SHA-256 `a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961`; size 1328 bytes\n SHA-1: `20018f98272589d9029983b59a24e1d7a33c43f2`; MD5: `c70b224c70055fed8774ce8918e5ba55`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7409,\"response_frame\":7492,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":126,\"url\":\"http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1328,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `pieceshash(3)`; SHA-256 `f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513`; size 1140 bytes\n SHA-1: `2c653ebc284f131243a6d6b3de98e8c4fc5118ec`; MD5: `b418325e6216c8b4ae84dffe52ef94df`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8927,\"response_frame\":8939,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":130,\"url\":\"http://dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":1140,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `pieceshash`; SHA-256 `7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48`; size 293 bytes\n SHA-1: `17a18d621840ecb17c8af2eeafa30b93a1d527ab`; MD5: `0c4798d76acbb2c2056233dd319d9a88`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5753,\"response_frame\":5767,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":109,\"url\":\"http://dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":293,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `pieceshash(1)`; SHA-256 `166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e`; size 198 bytes\n SHA-1: `3db76e52d8bf1b55f1d48057a7e166430ab02714`; MD5: `d58d73c26d3d4376db2fdc5203c1a74b`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":6576,\"response_frame\":6773,\"server_ip\":\"13.107.4.50\",\"status_code\":\"200\",\"tcp_stream\":122,\"url\":\"http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":198,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n- exported object `001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d`; SHA-256 `fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25`; size 2 bytes\n SHA-1: `e14e7438ed45ff5dc2ea8f847854b2fdc2afe1cf`; MD5: `d71bdd22c8bb93b8d287dce6f46aed25`; completeness: matches-declared-content-length; transfers: `[{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5870,\"response_frame\":5890,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":117,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5880,\"response_frame\":5891,\"server_ip\":\"205.185.216.10\",\"status_code\":\"206\",\"tcp_stream\":118,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5882,\"response_frame\":5892,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":119,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":5884,\"response_frame\":5893,\"server_ip\":\"205.185.216.10\",\"status_code\":\"206\",\"tcp_stream\":120,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7069,\"response_frame\":7395,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":125,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7066,\"response_frame\":7396,\"server_ip\":\"205.185.216.10\",\"status_code\":\"206\",\"tcp_stream\":124,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7710,\"response_frame\":7957,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":128,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":7720,\"response_frame\":8053,\"server_ip\":\"205.185.216.10\",\"status_code\":\"206\",\"tcp_stream\":127,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8949,\"response_frame\":8973,\"server_ip\":\"205.185.216.42\",\"status_code\":\"206\",\"tcp_stream\":131,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8951,\"response_frame\":8974,\"server_ip\":\"205.185.216.10\",\"status_code\":\"206\",\"tcp_stream\":132,\"url\":\"http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8991,\"response_frame\":9001,\"server_ip\":\"23.1.236.92\",\"status_code\":\"206\",\"tcp_stream\":136,\"url\":\"http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d\"},{\"client_ip\":\"172.17.8.174\",\"completeness\":\"matches-declared-content-length\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":8989,\"response_frame\":9002,\"server_ip\":\"23.1.236.114\",\"status_code\":\"206\",\"tcp_stream\":135,\"url\":\"http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d\"}]`.\n Extraction: tshark-http-export-objects; parent SHA-256: none.\n Redacted content structure: `{\"credential_record_present\":false,\"identities\":[],\"inspected_bytes\":2,\"private_key_marker_present\":false,\"scope\":\"Allowlisted structural features; secret values and arbitrary payload text omitted\",\"system_inventory_marker_present\":false,\"truncated\":false}`; do not infer the destination without an exact transfer binding.\n\n## Actor similarity leads\n\n- No actor lead was calculated.\n\n## Local enrichment and correlations\n\nNo match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.\nSnapshot: `6a03461060569af0c77daab88ab63819de6e1c6487437f55da1aa05dadc3739f`; recorded 2026-09-22T16:01:29.660633+00:00; mode: local-only.\nCoverage: `{\"matched_observables\":0,\"no_exact_match\":125,\"observable_limit\":5000,\"observables_checked\":125,\"observables_total\":125,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false}`\n\n- Prior analysis `246dbce6-c561-4434-bedb-dd496ba758d2` shares 35 observations. This does not establish a common campaign.\n- Prior analysis `c66676ab-7276-4989-8c27-65017a63c2ba` shares 19 observations. This does not establish a common campaign.\n- Prior analysis `476c88cb-8e1a-42e4-a8bd-e2ad2e63b0cd` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `044c22d0-fd65-4c60-8644-c22ff5e1b31c` shares 22 observations. This does not establish a common campaign.\n- Prior analysis `73129515-519f-4544-905f-145c9d2de3d8` shares 13 observations. This does not establish a common campaign.\n- Prior analysis `5ddffc9a-7544-4749-b7bc-17ad98beaadb` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `fc2de8b3-a6ce-4024-9d9b-5602034db53d` shares 14 observations. This does not establish a common campaign.\n- Prior analysis `b12014b8-9e64-4e70-bdb8-90620d23ac22` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `ada03a66-9d3d-4c08-b448-f9758ac8bac5` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `0b13588f-0835-4e15-9f97-8a9411ad7f7f` shares 24 observations. This does not establish a common campaign.\n- Prior analysis `92de15ed-01f0-4a43-8105-a56b60130430` shares 18 observations. This does not establish a common campaign.\n- Prior analysis `fdf1584a-1c2d-4a49-92b2-8dcb98436eb0` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `fab22e38-ca53-4105-924e-f5722b5f53fe` shares 29 observations. This does not establish a common campaign.\n- Prior analysis `31f265dc-3055-4628-8df4-136d4058e842` shares 2 observations. This does not establish a common campaign.\n- Prior analysis `b60c4dbb-eb8f-46a7-89b9-24606fd43e46` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `8174eaa7-e189-467f-b05e-fb7397bfcf16` shares 7 observations. This does not establish a common campaign.\n- Prior analysis `e37603cf-d241-45ee-95ec-bcf92a063147` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `7c54479c-cce3-4570-80c9-69d03571a645` shares 12 observations. This does not establish a common campaign.\n- Prior analysis `21da2cda-3a07-4c03-b352-af8740c84bc0` shares 11 observations. This does not establish a common campaign.\n- Prior analysis `9923b3d5-8d06-4f6a-b1f1-810507712be3` shares 24 observations. This does not establish a common campaign.\n- Prior analysis `8f0da1cd-9998-4d41-9fc7-683302a6ee24` shares 25 observations. This does not establish a common campaign.\n- Prior analysis `96e0e828-93ae-49d5-8104-9f14cb584c3e` shares 10 observations. This does not establish a common campaign.\n- Prior analysis `6e50c68f-5552-400c-9835-15867ddb022d` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `43bc93eb-d6db-4400-b983-b0dd404c8ca4` shares 26 observations. This does not establish a common campaign.\n- Prior analysis `6df36b51-4b44-4660-b534-2fa89705e807` shares 15 observations. This does not establish a common campaign.\n- Prior analysis `29aa3ef8-47c9-4c47-b4cc-1ff3e0708142` shares 8 observations. This does not establish a common campaign.\n- Prior analysis `b79032a8-d69e-4ac1-bdd4-542473fa8e3b` shares 16 observations. This does not establish a common campaign.\n- Prior analysis `faf041c3-70e0-4a01-8780-10917e5e187c` shares 8 observations. This does not establish a common campaign.\n- External provider queries: 0. Not requested; no unknown indicator is classified as benign.\n\n## Coverage and limitations\n\n- Packet and protocol facts are deterministic for the recorded analyzer manifest.\n- Encrypted application payloads are not decrypted; only available metadata is reported.\n- ATT&CK mappings and actor overlaps are candidates until analyst review and promotion.\n- HTTP object inventory: `{\"compact_objects\":0,\"complete\":true,\"detailed_objects\":10,\"export_status\":\"completed\",\"exported_objects\":21,\"hashed_bytes\":2812152,\"hashed_objects\":21,\"omitted_unique_hashes\":0,\"returned_unique_hashes\":10,\"selection\":\"content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index\",\"unhashed_objects\":0,\"unique_hashes\":10}`. Compact overflow hashes are retained in JSON coverage and observables.\n- A directory subject is not necessarily a logged-in user; consult identity bindings in the JSON evidence.\n- Rendered / available: findings 6/6, identities 7/7, observables 125/125, artifacts 10/10. Full returned inventory is in the JSON result.\n\n## Evidence-backed IOC assessment\n\n117 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.\n\nPolicy: `pcap-assessment-v3`; assessment SHA-256: `dc62e368b6df6755c4974fdbfa44cca4c837d0ecedd81aaadc2752a621ade5f0`.\n\n\nOrdinary observations remain in the capture inventory; they are not declared malicious IOCs.\n\nReputation snapshot: `cf2d4c3bb8c2bbb049d56945f2458679b410937b6395af4af60e6ba16c7bdc62`; updated 2026-09-22T17:45:36.250079+00:00. Each target retains its query time. Coverage: `{\"active_scans\":0,\"batch_results\":[{\"observable_id\":\"observable-ef5bbf89cf708c774c6a436d\",\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\"},{\"observable_id\":\"observable-ef5bbf89cf708c774c6a436d\",\"provider\":\"threatfox\",\"status\":\"not_found\"}],\"batch_targets\":1,\"cache_hits\":0,\"full_urls_disclosed\":0,\"payload_uploads\":0,\"provider_lookups_started\":1,\"retained_targets\":61,\"targets_omitted\":0}`.\n- No detections, no record, missing credentials and provider errors do not mean benign.\n- Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.\n- A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.\n- Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure.\n", "result": { "flows": [ { "bytes": 381, "stream": 0, "flow_id": "flow-71f07f2a08ebe535e579688f", "packets": 1, "transport": "udp", "last_frame": 1, "first_frame": 1, "initiator_ip": "0.0.0.0", "responder_ip": "255.255.255.255", "initiator_port": 68, "responder_port": 67, "initiator_bytes": 381, "last_seen_epoch": "1582246430.628828", "responder_bytes": 0, "first_seen_epoch": "1582246430.628828" }, { "bytes": 342, "stream": 1, "flow_id": "flow-2f1ecb2fe5c345591de4d596", "packets": 1, "transport": "udp", "last_frame": 2, "first_frame": 2, "initiator_ip": "172.17.8.8", "responder_ip": "172.17.8.174", "initiator_port": 67, "responder_port": 68, "initiator_bytes": 342, "last_seen_epoch": "1582246430.629296", "responder_bytes": 0, "first_seen_epoch": "1582246430.629296" }, { "bytes": 344, "stream": 2, "flow_id": "flow-72a1dc9bd0398b40c2cdb417", "packets": 4, "transport": "udp", "last_frame": 2224, "first_frame": 5, "initiator_ip": "172.17.8.174", "responder_ip": "224.0.0.251", "initiator_port": 5353, "responder_port": 5353, "initiator_bytes": 344, "last_seen_epoch": "1582247330.05709", "responder_bytes": 0, "first_seen_epoch": "1582246430.82764" }, { "bytes": 75, "stream": 3, "flow_id": "flow-bf2e1611c1b017770046999c", "packets": 1, "transport": "udp", "last_frame": 7, "first_frame": 7, "initiator_ip": "172.17.8.174", "responder_ip": "224.0.0.252", "initiator_port": 59336, "responder_port": 5355, "initiator_bytes": 75, "last_seen_epoch": "1582246430.832491", "responder_bytes": 0, "first_seen_epoch": "1582246430.832491" }, { "bytes": 262, "stream": 4, "flow_id": "flow-b73bba793f296f360e4fdf80", "packets": 2, "transport": "udp", "last_frame": 10, "first_frame": 9, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 64898, "responder_port": 53, "initiator_bytes": 97, "last_seen_epoch": "1582246431.132004", "responder_bytes": 165, "first_seen_epoch": "1582246431.131746" }, { "bytes": 200, "stream": 5, "flow_id": "flow-7534bfaae1f2c2d82b9e4530", "packets": 2, "transport": "udp", "last_frame": 12, "first_frame": 11, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62494, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582246431.141527", "responder_bytes": 108, "first_seen_epoch": "1582246431.141151" }, { "bytes": 512, "stream": 6, "flow_id": "flow-5b336fe3335687d0df253c9c", "packets": 2, "transport": "udp", "last_frame": 14, "first_frame": 13, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62496, "responder_port": 389, "initiator_bytes": 268, "last_seen_epoch": "1582246431.158848", "responder_bytes": 244, "first_seen_epoch": "1582246431.158432" }, { "bytes": 297, "stream": 7, "flow_id": "flow-2b2bef57d0dde7ca210a9cf9", "packets": 2, "transport": "udp", "last_frame": 16, "first_frame": 15, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 63374, "responder_port": 53, "initiator_bytes": 109, "last_seen_epoch": "1582246431.240993", "responder_bytes": 188, "first_seen_epoch": "1582246431.240373" }, { "bytes": 297, "stream": 8, "flow_id": "flow-6ea7a94ffa82323d19b3dbb1", "packets": 2, "transport": "udp", "last_frame": 18, "first_frame": 17, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49614, "responder_port": 53, "initiator_bytes": 109, "last_seen_epoch": "1582246431.246862", "responder_bytes": 188, "first_seen_epoch": "1582246431.246455" }, { "bytes": 6217, "stream": 0, "flow_id": "flow-823d40cb5ede1fe76f563a15", "packets": 15, "transport": "tcp", "last_frame": 205, "first_frame": 19, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49668, "responder_port": 389, "initiator_bytes": 2806, "last_seen_epoch": "1582246432.417847", "responder_bytes": 3411, "first_seen_epoch": "1582246431.266496" }, { "bytes": 168, "stream": 9, "flow_id": "flow-edfaaf0c5453b5fdcf41ddb2", "packets": 2, "transport": "udp", "last_frame": 31, "first_frame": 26, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 50066, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1582246431.554751", "responder_bytes": 92, "first_seen_epoch": "1582246431.364587" }, { "bytes": 241, "stream": 10, "flow_id": "flow-d31dd2d83691c48bebf8be25", "packets": 2, "transport": "udp", "last_frame": 28, "first_frame": 27, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 58724, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1582246431.535139", "responder_bytes": 160, "first_seen_epoch": "1582246431.534875" }, { "bytes": 227, "stream": 11, "flow_id": "flow-cd56aab773dcac6c1c8a7722", "packets": 2, "transport": "udp", "last_frame": 30, "first_frame": 29, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 55851, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1582246431.541833", "responder_bytes": 151, "first_seen_epoch": "1582246431.541544" }, { "bytes": 4290, "stream": 12, "flow_id": "flow-9156535f8e882d4f9da43c4f", "packets": 39, "transport": "udp", "last_frame": 5514, "first_frame": 32, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.1", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 4290, "last_seen_epoch": "1582247573.086466", "responder_bytes": 0, "first_seen_epoch": "1582246432.114052" }, { "bytes": 512, "stream": 13, "flow_id": "flow-544073cbe1ef0ac816e294f4", "packets": 2, "transport": "udp", "last_frame": 35, "first_frame": 34, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 55853, "responder_port": 389, "initiator_bytes": 268, "last_seen_epoch": "1582246432.183782", "responder_bytes": 244, "first_seen_epoch": "1582246432.183152" }, { "bytes": 324, "stream": 14, "flow_id": "flow-d1070a88a3a8ca8fb35197ce", "packets": 2, "transport": "udp", "last_frame": 37, "first_frame": 36, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61942, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1582246432.227512", "responder_bytes": 196, "first_seen_epoch": "1582246432.227241" }, { "bytes": 576, "stream": 15, "flow_id": "flow-385f21522d247cf027521ba9", "packets": 2, "transport": "udp", "last_frame": 39, "first_frame": 38, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61944, "responder_port": 389, "initiator_bytes": 315, "last_seen_epoch": "1582246432.245354", "responder_bytes": 261, "first_seen_epoch": "1582246432.2449" }, { "bytes": 556, "stream": 16, "flow_id": "flow-6d88cad00454b024e584759d", "packets": 2, "transport": "udp", "last_frame": 41, "first_frame": 40, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61945, "responder_port": 389, "initiator_bytes": 312, "last_seen_epoch": "1582246432.250448", "responder_bytes": 244, "first_seen_epoch": "1582246432.250169" }, { "bytes": 332, "stream": 17, "flow_id": "flow-18f17dbe6381057fee0651d9", "packets": 2, "transport": "udp", "last_frame": 43, "first_frame": 42, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 59398, "responder_port": 53, "initiator_bytes": 132, "last_seen_epoch": "1582246432.289581", "responder_bytes": 200, "first_seen_epoch": "1582246432.289334" }, { "bytes": 512, "stream": 18, "flow_id": "flow-ee5b7a1682daf5541f8afe43", "packets": 2, "transport": "udp", "last_frame": 45, "first_frame": 44, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 59399, "responder_port": 389, "initiator_bytes": 268, "last_seen_epoch": "1582246432.291856", "responder_bytes": 244, "first_seen_epoch": "1582246432.291582" }, { "bytes": 44519, "stream": 1, "flow_id": "flow-61dd0c2f1309cd24fb9cfc2c", "packets": 171, "transport": "tcp", "last_frame": 1782, "first_frame": 46, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49671, "responder_port": 445, "initiator_bytes": 23202, "last_seen_epoch": "1582246615.07044", "responder_bytes": 21317, "first_seen_epoch": "1582246432.332247" }, { "bytes": 513, "stream": 19, "flow_id": "flow-aa4da178a4820f5ab41ffa26", "packets": 2, "transport": "udp", "last_frame": 50, "first_frame": 49, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 59400, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246432.354248", "responder_bytes": 244, "first_seen_epoch": "1582246432.353945" }, { "bytes": 3762, "stream": 2, "flow_id": "flow-b406bdd8576c953cc305b0dd", "packets": 23, "transport": "tcp", "last_frame": 1295, "first_frame": 51, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49672, "responder_port": 135, "initiator_bytes": 1816, "last_seen_epoch": "1582246490.067959", "responder_bytes": 1946, "first_seen_epoch": "1582246432.363952" }, { "bytes": 4560, "stream": 3, "flow_id": "flow-399566134a883710beb71a5f", "packets": 20, "transport": "tcp", "last_frame": 1028, "first_frame": 62, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49673, "responder_port": 49670, "initiator_bytes": 2646, "last_seen_epoch": "1582246460.00441", "responder_bytes": 1914, "first_seen_epoch": "1582246432.366231" }, { "bytes": 9995, "stream": 4, "flow_id": "flow-216214316c8308c2ee32d536", "packets": 32, "transport": "tcp", "last_frame": 325, "first_frame": 77, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49674, "responder_port": 389, "initiator_bytes": 4829, "last_seen_epoch": "1582246432.780056", "responder_bytes": 5166, "first_seen_epoch": "1582246432.38194" }, { "bytes": 936, "stream": 5, "flow_id": "flow-df770a87ed8c1a2f7322953b", "packets": 8, "transport": "tcp", "last_frame": 91, "first_frame": 84, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49675, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1582246432.386344", "responder_bytes": 460, "first_seen_epoch": "1582246432.385092" }, { "bytes": 936, "stream": 6, "flow_id": "flow-79f9920159e4ea96c15fa6ba", "packets": 8, "transport": "tcp", "last_frame": 99, "first_frame": 92, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49676, "responder_port": 88, "initiator_bytes": 476, "last_seen_epoch": "1582246432.388217", "responder_bytes": 460, "first_seen_epoch": "1582246432.387105" }, { "bytes": 2559, "stream": 7, "flow_id": "flow-7b8af362683fce85c96399a0", "packets": 10, "transport": "tcp", "last_frame": 125, "first_frame": 102, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49677, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1582246432.398718", "responder_bytes": 1949, "first_seen_epoch": "1582246432.395726" }, { "bytes": 882, "stream": 8, "flow_id": "flow-2ba7f3fb9addada094046775", "packets": 7, "transport": "tcp", "last_frame": 123, "first_frame": 103, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49678, "responder_port": 88, "initiator_bytes": 422, "last_seen_epoch": "1582246432.398576", "responder_bytes": 460, "first_seen_epoch": "1582246432.395833" }, { "bytes": 2559, "stream": 9, "flow_id": "flow-be98f9455805e7e4faa7bb1a", "packets": 10, "transport": "tcp", "last_frame": 128, "first_frame": 106, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49679, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1582246432.399034", "responder_bytes": 1949, "first_seen_epoch": "1582246432.396704" }, { "bytes": 2559, "stream": 10, "flow_id": "flow-c2d72da1893634df9a41b2d5", "packets": 10, "transport": "tcp", "last_frame": 139, "first_frame": 129, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49680, "responder_port": 88, "initiator_bytes": 610, "last_seen_epoch": "1582246432.409327", "responder_bytes": 1949, "first_seen_epoch": "1582246432.406317" }, { "bytes": 4107, "stream": 11, "flow_id": "flow-98c75a06bd8203f654038eb3", "packets": 12, "transport": "tcp", "last_frame": 166, "first_frame": 140, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49681, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1582246432.413461", "responder_bytes": 2045, "first_seen_epoch": "1582246432.411634" }, { "bytes": 4107, "stream": 12, "flow_id": "flow-bb6c4eb25bf3dd55dda9641a", "packets": 12, "transport": "tcp", "last_frame": 169, "first_frame": 142, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49682, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1582246432.413684", "responder_bytes": 2045, "first_seen_epoch": "1582246432.411802" }, { "bytes": 4069, "stream": 13, "flow_id": "flow-2b3e81fde8d3b200e4e507ab", "packets": 12, "transport": "tcp", "last_frame": 176, "first_frame": 151, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49683, "responder_port": 88, "initiator_bytes": 2044, "last_seen_epoch": "1582246432.414002", "responder_bytes": 2025, "first_seen_epoch": "1582246432.412233" }, { "bytes": 3703, "stream": 14, "flow_id": "flow-ce1e1484c49f86f13ec96b7a", "packets": 12, "transport": "tcp", "last_frame": 195, "first_frame": 179, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49684, "responder_port": 88, "initiator_bytes": 1837, "last_seen_epoch": "1582246432.416022", "responder_bytes": 1866, "first_seen_epoch": "1582246432.414207" }, { "bytes": 334, "stream": 20, "flow_id": "flow-0caad73564f8119081f98d74", "packets": 2, "transport": "udp", "last_frame": 213, "first_frame": 211, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 63275, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1582246432.419998", "responder_bytes": 201, "first_seen_epoch": "1582246432.419782" }, { "bytes": 493, "stream": 21, "flow_id": "flow-d142761c14cc251fd394a47a", "packets": 2, "transport": "udp", "last_frame": 216, "first_frame": 215, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 63276, "responder_port": 389, "initiator_bytes": 247, "last_seen_epoch": "1582246432.420817", "responder_bytes": 246, "first_seen_epoch": "1582246432.420557" }, { "bytes": 20402, "stream": 15, "flow_id": "flow-0ca88b6d65c39239a0c725d1", "packets": 62, "transport": "tcp", "last_frame": 1294, "first_frame": 222, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49685, "responder_port": 49670, "initiator_bytes": 13992, "last_seen_epoch": "1582246490.067811", "responder_bytes": 6410, "first_seen_epoch": "1582246432.461101" }, { "bytes": 348, "stream": 16, "flow_id": "flow-a02e603b9368d9cbc229708c", "packets": 6, "transport": "tcp", "last_frame": 263, "first_frame": 257, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49686, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1582246432.536974", "responder_bytes": 174, "first_seen_epoch": "1582246432.534596" }, { "bytes": 334, "stream": 22, "flow_id": "flow-2e2bfa6c243c053b9b4610d7", "packets": 2, "transport": "udp", "last_frame": 266, "first_frame": 265, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 58981, "responder_port": 53, "initiator_bytes": 133, "last_seen_epoch": "1582246432.53753", "responder_bytes": 201, "first_seen_epoch": "1582246432.537388" }, { "bytes": 493, "stream": 23, "flow_id": "flow-009509477924880d0f7febf5", "packets": 2, "transport": "udp", "last_frame": 268, "first_frame": 267, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 58982, "responder_port": 389, "initiator_bytes": 247, "last_seen_epoch": "1582246432.5389", "responder_bytes": 246, "first_seen_epoch": "1582246432.538687" }, { "bytes": 348, "stream": 17, "flow_id": "flow-0d1b638b4aab99127dd2d57a", "packets": 6, "transport": "tcp", "last_frame": 276, "first_frame": 270, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49687, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1582246432.651914", "responder_bytes": 174, "first_seen_epoch": "1582246432.644699" }, { "bytes": 304, "stream": 24, "flow_id": "flow-14ebe519c93b086ee422b178", "packets": 2, "transport": "udp", "last_frame": 280, "first_frame": 278, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62862, "responder_port": 53, "initiator_bytes": 118, "last_seen_epoch": "1582246432.653831", "responder_bytes": 186, "first_seen_epoch": "1582246432.65359" }, { "bytes": 512, "stream": 25, "flow_id": "flow-42708377475ff396c93723bf", "packets": 2, "transport": "udp", "last_frame": 285, "first_frame": 282, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62863, "responder_port": 389, "initiator_bytes": 268, "last_seen_epoch": "1582246432.654412", "responder_bytes": 244, "first_seen_epoch": "1582246432.654216" }, { "bytes": 200, "stream": 26, "flow_id": "flow-50e281f04f0c7e67e4840507", "packets": 2, "transport": "udp", "last_frame": 302, "first_frame": 301, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 63487, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582246432.718966", "responder_bytes": 108, "first_seen_epoch": "1582246432.718664" }, { "bytes": 348, "stream": 18, "flow_id": "flow-585709ecd1b3ec9be9b36d4b", "packets": 6, "transport": "tcp", "last_frame": 309, "first_frame": 303, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49688, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1582246432.774034", "responder_bytes": 174, "first_seen_epoch": "1582246432.768883" }, { "bytes": 348, "stream": 19, "flow_id": "flow-fd51344bbdb7b1106d6bd674", "packets": 6, "transport": "tcp", "last_frame": 318, "first_frame": 311, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49689, "responder_port": 389, "initiator_bytes": 174, "last_seen_epoch": "1582246432.778931", "responder_bytes": 174, "first_seen_epoch": "1582246432.774756" }, { "bytes": 8875, "stream": 20, "flow_id": "flow-7c7ed150e050180fd4a5ffb5", "packets": 18, "transport": "tcp", "last_frame": 511, "first_frame": 326, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49691, "responder_port": 389, "initiator_bytes": 3676, "last_seen_epoch": "1582246433.23434", "responder_bytes": 5199, "first_seen_epoch": "1582246432.986915" }, { "bytes": 4003, "stream": 21, "flow_id": "flow-e5e2427ea6a854ee19396711", "packets": 12, "transport": "tcp", "last_frame": 348, "first_frame": 337, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49692, "responder_port": 88, "initiator_bytes": 2022, "last_seen_epoch": "1582246433.008019", "responder_bytes": 1981, "first_seen_epoch": "1582246433.006033" }, { "bytes": 3774, "stream": 22, "flow_id": "flow-00b59178ab0110121d55e960", "packets": 16, "transport": "tcp", "last_frame": 509, "first_frame": 351, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49693, "responder_port": 389, "initiator_bytes": 2864, "last_seen_epoch": "1582246433.213739", "responder_bytes": 910, "first_seen_epoch": "1582246433.012196" }, { "bytes": 4107, "stream": 23, "flow_id": "flow-db59264b3523c9259ad55d88", "packets": 12, "transport": "tcp", "last_frame": 377, "first_frame": 366, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49694, "responder_port": 88, "initiator_bytes": 2062, "last_seen_epoch": "1582246433.098593", "responder_bytes": 2045, "first_seen_epoch": "1582246433.097172" }, { "bytes": 3703, "stream": 24, "flow_id": "flow-560ce224f721611763ae778d", "packets": 12, "transport": "tcp", "last_frame": 389, "first_frame": 378, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49695, "responder_port": 88, "initiator_bytes": 1837, "last_seen_epoch": "1582246433.100057", "responder_bytes": 1866, "first_seen_epoch": "1582246433.098702" }, { "bytes": 324, "stream": 27, "flow_id": "flow-379011d09a2047dde1411f97", "packets": 2, "transport": "udp", "last_frame": 517, "first_frame": 516, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60761, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1582246434.315645", "responder_bytes": 196, "first_seen_epoch": "1582246434.315409" }, { "bytes": 513, "stream": 28, "flow_id": "flow-1a99d74765a368805c26c1c2", "packets": 2, "transport": "udp", "last_frame": 519, "first_frame": 518, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60762, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246434.316273", "responder_bytes": 244, "first_seen_epoch": "1582246434.316082" }, { "bytes": 1770, "stream": 25, "flow_id": "flow-b5acdc03f4e3ec895d85fc6d", "packets": 11, "transport": "tcp", "last_frame": 591, "first_frame": 520, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49697, "responder_port": 135, "initiator_bytes": 898, "last_seen_epoch": "1582246434.476135", "responder_bytes": 872, "first_seen_epoch": "1582246434.43662" }, { "bytes": 6777, "stream": 26, "flow_id": "flow-b34ad46faf3b8acb7cde337a", "packets": 23, "transport": "tcp", "last_frame": 592, "first_frame": 527, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49698, "responder_port": 49670, "initiator_bytes": 4356, "last_seen_epoch": "1582246434.476596", "responder_bytes": 2421, "first_seen_epoch": "1582246434.440507" }, { "bytes": 7492, "stream": 27, "flow_id": "flow-196269f20641298fc29f3431", "packets": 21, "transport": "tcp", "last_frame": 588, "first_frame": 550, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49699, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1582246434.45979", "responder_bytes": 4061, "first_seen_epoch": "1582246434.449879" }, { "bytes": 6906, "stream": 28, "flow_id": "flow-5532c8e607123c3f13416875", "packets": 18, "transport": "tcp", "last_frame": 585, "first_frame": 567, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49700, "responder_port": 389, "initiator_bytes": 2831, "last_seen_epoch": "1582246434.45962", "responder_bytes": 4075, "first_seen_epoch": "1582246434.455618" }, { "bytes": 263, "stream": 29, "flow_id": "flow-d1567467262bae2a3e54c933", "packets": 2, "transport": "udp", "last_frame": 597, "first_frame": 596, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62148, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582246435.852236", "responder_bytes": 171, "first_seen_epoch": "1582246435.851831" }, { "bytes": 320, "stream": 30, "flow_id": "flow-61db99f3a0dcb8f6757799f5", "packets": 2, "transport": "udp", "last_frame": 599, "first_frame": 598, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62362, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1582246435.85518", "responder_bytes": 160, "first_seen_epoch": "1582246435.853954" }, { "bytes": 1320, "stream": 31, "flow_id": "flow-6f6f555a68027026fd4caffd", "packets": 12, "transport": "udp", "last_frame": 613, "first_frame": 600, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.255", "initiator_port": 137, "responder_port": 137, "initiator_bytes": 1320, "last_seen_epoch": "1582246439.80218", "responder_bytes": 0, "first_seen_epoch": "1582246436.770248" }, { "bytes": 109, "stream": 29, "flow_id": "flow-e303340e114eed42d4a89837", "packets": 2, "transport": "tcp", "last_frame": 609, "first_frame": 608, "initiator_ip": "172.17.8.8", "responder_ip": "172.17.8.174", "initiator_port": 445, "responder_port": 49711, "initiator_bytes": 55, "last_seen_epoch": "1582246438.831535", "responder_bytes": 54, "first_seen_epoch": "1582246438.831061" }, { "bytes": 513, "stream": 32, "flow_id": "flow-0e8aa4813a821dcad91c1f93", "packets": 2, "transport": "udp", "last_frame": 615, "first_frame": 614, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62363, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246440.579164", "responder_bytes": 244, "first_seen_epoch": "1582246440.578779" }, { "bytes": 729, "stream": 33, "flow_id": "flow-332d88bd43aebe05aa96aaa7", "packets": 3, "transport": "udp", "last_frame": 2184, "first_frame": 616, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.255", "initiator_port": 138, "responder_port": 138, "initiator_bytes": 729, "last_seen_epoch": "1582247157.859759", "responder_bytes": 0, "first_seen_epoch": "1582246440.592958" }, { "bytes": 513, "stream": 34, "flow_id": "flow-77ccb71b1088ae51abc343f4", "packets": 2, "transport": "udp", "last_frame": 618, "first_frame": 617, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62365, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246441.497518", "responder_bytes": 244, "first_seen_epoch": "1582246441.497105" }, { "bytes": 8327, "stream": 30, "flow_id": "flow-63c23a14a8b9bdbe736ca2a4", "packets": 25, "transport": "tcp", "last_frame": 673, "first_frame": 619, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49701, "responder_port": 389, "initiator_bytes": 3909, "last_seen_epoch": "1582246441.632765", "responder_bytes": 4418, "first_seen_epoch": "1582246441.615293" }, { "bytes": 955, "stream": 31, "flow_id": "flow-3db540b87ee6fd3d591c0e29", "packets": 8, "transport": "tcp", "last_frame": 647, "first_frame": 640, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49702, "responder_port": 88, "initiator_bytes": 477, "last_seen_epoch": "1582246441.628411", "responder_bytes": 478, "first_seen_epoch": "1582246441.627233" }, { "bytes": 2560, "stream": 32, "flow_id": "flow-dd32c7384f3ab5616df488c7", "packets": 10, "transport": "tcp", "last_frame": 657, "first_frame": 648, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49703, "responder_port": 88, "initiator_bytes": 611, "last_seen_epoch": "1582246441.629744", "responder_bytes": 1949, "first_seen_epoch": "1582246441.62843" }, { "bytes": 3941, "stream": 33, "flow_id": "flow-9fda5ef713142d76fcb55941", "packets": 12, "transport": "tcp", "last_frame": 669, "first_frame": 658, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49704, "responder_port": 88, "initiator_bytes": 1988, "last_seen_epoch": "1582246441.631246", "responder_bytes": 1953, "first_seen_epoch": "1582246441.629854" }, { "bytes": 648, "stream": 35, "flow_id": "flow-3a71f4332e493b1619858674", "packets": 4, "transport": "udp", "last_frame": 4416, "first_frame": 674, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 123, "responder_port": 123, "initiator_bytes": 324, "last_seen_epoch": "1582247466.229526", "responder_bytes": 324, "first_seen_epoch": "1582246442.210946" }, { "bytes": 347, "stream": 36, "flow_id": "flow-9219d93750c3eded5f95c052", "packets": 2, "transport": "udp", "last_frame": 677, "first_frame": 676, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61536, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1582246443.041084", "responder_bytes": 257, "first_seen_epoch": "1582246442.929497" }, { "bytes": 10818, "stream": 34, "flow_id": "flow-abff34edfa5da5222428cd60", "packets": 30, "transport": "tcp", "last_frame": 1706, "first_frame": 678, "initiator_ip": "172.17.8.174", "responder_ip": "52.114.132.22", "initiator_port": 49705, "responder_port": 443, "initiator_bytes": 3441, "last_seen_epoch": "1582246553.397418", "responder_bytes": 7377, "first_seen_epoch": "1582246443.045826" }, { "bytes": 241, "stream": 37, "flow_id": "flow-e237f4bede1666e323c26c70", "packets": 2, "transport": "udp", "last_frame": 710, "first_frame": 709, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54516, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1582246446.554749", "responder_bytes": 160, "first_seen_epoch": "1582246446.554333" }, { "bytes": 227, "stream": 38, "flow_id": "flow-c8c8293873cae67879e75351", "packets": 2, "transport": "udp", "last_frame": 712, "first_frame": 711, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60335, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1582246446.555436", "responder_bytes": 151, "first_seen_epoch": "1582246446.555212" }, { "bytes": 513, "stream": 39, "flow_id": "flow-2d6078ebae421fe40b3495e5", "packets": 2, "transport": "udp", "last_frame": 714, "first_frame": 713, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60336, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246451.973427", "responder_bytes": 244, "first_seen_epoch": "1582246451.973046" }, { "bytes": 902, "stream": 35, "flow_id": "flow-2f3eb017a1d0853a989163f0", "packets": 8, "transport": "tcp", "last_frame": 722, "first_frame": 715, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49706, "responder_port": 88, "initiator_bytes": 469, "last_seen_epoch": "1582246452.086512", "responder_bytes": 433, "first_seen_epoch": "1582246452.083179" }, { "bytes": 2575, "stream": 36, "flow_id": "flow-c8cb547cf0a846fdc502e423", "packets": 10, "transport": "tcp", "last_frame": 732, "first_frame": 723, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49707, "responder_port": 88, "initiator_bytes": 603, "last_seen_epoch": "1582246452.097749", "responder_bytes": 1972, "first_seen_epoch": "1582246452.092991" }, { "bytes": 3892, "stream": 37, "flow_id": "flow-9374dc3465b75eb8979d791c", "packets": 12, "transport": "tcp", "last_frame": 744, "first_frame": 733, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49708, "responder_port": 88, "initiator_bytes": 1931, "last_seen_epoch": "1582246452.099347", "responder_bytes": 1961, "first_seen_epoch": "1582246452.09795" }, { "bytes": 4191, "stream": 38, "flow_id": "flow-b2d1cae838f26b56e74bfa5b", "packets": 12, "transport": "tcp", "last_frame": 758, "first_frame": 747, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49709, "responder_port": 88, "initiator_bytes": 2104, "last_seen_epoch": "1582246452.172671", "responder_bytes": 2087, "first_seen_epoch": "1582246452.169475" }, { "bytes": 168, "stream": 40, "flow_id": "flow-488e11fd4f72eb6cd8b6ecec", "packets": 2, "transport": "udp", "last_frame": 774, "first_frame": 773, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 59333, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1582246452.179824", "responder_bytes": 92, "first_seen_epoch": "1582246452.17961" }, { "bytes": 14289, "stream": 39, "flow_id": "flow-a81d7ac946552679db17024a", "packets": 61, "transport": "tcp", "last_frame": 1211, "first_frame": 775, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49710, "responder_port": 445, "initiator_bytes": 7053, "last_seen_epoch": "1582246464.677702", "responder_bytes": 7236, "first_seen_epoch": "1582246452.185169" }, { "bytes": 2403, "stream": 40, "flow_id": "flow-fb7f3510281ae63198fbb660", "packets": 10, "transport": "tcp", "last_frame": 792, "first_frame": 783, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49711, "responder_port": 88, "initiator_bytes": 2016, "last_seen_epoch": "1582246452.195933", "responder_bytes": 387, "first_seen_epoch": "1582246452.190617" }, { "bytes": 14014, "stream": 41, "flow_id": "flow-46bb64d08e8cfeeefe96dcad", "packets": 81, "transport": "tcp", "last_frame": 5519, "first_frame": 838, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49712, "responder_port": 445, "initiator_bytes": 8964, "last_seen_epoch": "1582247632.709409", "responder_bytes": 5050, "first_seen_epoch": "1582246452.273637" }, { "bytes": 4102, "stream": 42, "flow_id": "flow-5faa817e0739ac687fc439ca", "packets": 12, "transport": "tcp", "last_frame": 860, "first_frame": 849, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49713, "responder_port": 88, "initiator_bytes": 2069, "last_seen_epoch": "1582246452.312221", "responder_bytes": 2033, "first_seen_epoch": "1582246452.308973" }, { "bytes": 3787, "stream": 43, "flow_id": "flow-b3cd5178b457255a195ce46d", "packets": 12, "transport": "tcp", "last_frame": 873, "first_frame": 861, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49714, "responder_port": 88, "initiator_bytes": 1879, "last_seen_epoch": "1582246452.315275", "responder_bytes": 1908, "first_seen_epoch": "1582246452.312287" }, { "bytes": 4305, "stream": 44, "flow_id": "flow-48462074ae52ed4037ad0982", "packets": 14, "transport": "tcp", "last_frame": 918, "first_frame": 890, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49715, "responder_port": 389, "initiator_bytes": 3215, "last_seen_epoch": "1582246452.867175", "responder_bytes": 1090, "first_seen_epoch": "1582246452.514436" }, { "bytes": 3732, "stream": 45, "flow_id": "flow-c59af46098a8dcea765e3c93", "packets": 14, "transport": "tcp", "last_frame": 916, "first_frame": 899, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49716, "responder_port": 389, "initiator_bytes": 2876, "last_seen_epoch": "1582246452.860632", "responder_bytes": 856, "first_seen_epoch": "1582246452.527383" }, { "bytes": 265, "stream": 41, "flow_id": "flow-828c97593aa9a07a5b0bc2d3", "packets": 2, "transport": "udp", "last_frame": 924, "first_frame": 921, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 64886, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1582246456.608292", "responder_bytes": 193, "first_seen_epoch": "1582246456.491647" }, { "bytes": 452, "stream": 42, "flow_id": "flow-fff9a8a146a3ddfdfb8cc8e9", "packets": 5, "transport": "udp", "last_frame": 1035, "first_frame": 922, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 50065, "responder_port": 53, "initiator_bytes": 308, "last_seen_epoch": "1582246460.902826", "responder_bytes": 144, "first_seen_epoch": "1582246456.548808" }, { "bytes": 339, "stream": 43, "flow_id": "flow-4ac63f6a9b98eb8c2abf338f", "packets": 3, "transport": "udp", "last_frame": 936, "first_frame": 923, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54926, "responder_port": 53, "initiator_bytes": 162, "last_seen_epoch": "1582246457.808708", "responder_bytes": 177, "first_seen_epoch": "1582246456.602562" }, { "bytes": 7871, "stream": 46, "flow_id": "flow-09b3cd5ddc196edcaa5436b7", "packets": 26, "transport": "tcp", "last_frame": 1750, "first_frame": 925, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.200", "initiator_port": 49717, "responder_port": 443, "initiator_bytes": 1201, "last_seen_epoch": "1582246585.147365", "responder_bytes": 6670, "first_seen_epoch": "1582246456.612741" }, { "bytes": 298, "stream": 44, "flow_id": "flow-c8eab481fff54e4bb156628d", "packets": 3, "transport": "udp", "last_frame": 937, "first_frame": 926, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 58257, "responder_port": 53, "initiator_bytes": 154, "last_seen_epoch": "1582246457.808767", "responder_bytes": 144, "first_seen_epoch": "1582246456.627661" }, { "bytes": 15975, "stream": 47, "flow_id": "flow-5f7393b4d0496e44b803c85a", "packets": 46, "transport": "tcp", "last_frame": 1768, "first_frame": 927, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.200", "initiator_port": 49718, "responder_port": 443, "initiator_bytes": 8077, "last_seen_epoch": "1582246596.916702", "responder_bytes": 7898, "first_seen_epoch": "1582246457.103904" }, { "bytes": 7359, "stream": 48, "flow_id": "flow-a3ca5364645268644d4593b3", "packets": 26, "transport": "tcp", "last_frame": 4418, "first_frame": 938, "initiator_ip": "172.17.8.174", "responder_ip": "23.54.20.139", "initiator_port": 49719, "responder_port": 443, "initiator_bytes": 1112, "last_seen_epoch": "1582247504.473667", "responder_bytes": 6247, "first_seen_epoch": "1582246457.809369" }, { "bytes": 6341, "stream": 49, "flow_id": "flow-4a05279c6812eba0fdd57a9f", "packets": 22, "transport": "tcp", "last_frame": 1764, "first_frame": 939, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.4.254", "initiator_port": 49720, "responder_port": 443, "initiator_bytes": 1032, "last_seen_epoch": "1582246586.95866", "responder_bytes": 5309, "first_seen_epoch": "1582246457.809885" }, { "bytes": 6608, "stream": 50, "flow_id": "flow-2d1e691b11ce9bd710b24b5a", "packets": 22, "transport": "tcp", "last_frame": 1765, "first_frame": 1036, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.254", "initiator_port": 49721, "responder_port": 443, "initiator_bytes": 1032, "last_seen_epoch": "1582246588.521885", "responder_bytes": 5576, "first_seen_epoch": "1582246460.903901" }, { "bytes": 16906, "stream": 51, "flow_id": "flow-af89aeb9b3bdc79a79ac70f7", "packets": 35, "transport": "tcp", "last_frame": 1694, "first_frame": 1062, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.200", "initiator_port": 49722, "responder_port": 443, "initiator_bytes": 3383, "last_seen_epoch": "1582246522.83805", "responder_bytes": 13523, "first_seen_epoch": "1582246462.091288" }, { "bytes": 1770, "stream": 52, "flow_id": "flow-5b9e332777c601a501fb0028", "packets": 11, "transport": "tcp", "last_frame": 1228, "first_frame": 1108, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49723, "responder_port": 135, "initiator_bytes": 898, "last_seen_epoch": "1582246466.3991", "responder_bytes": 872, "first_seen_epoch": "1582246463.990018" }, { "bytes": 6819, "stream": 53, "flow_id": "flow-2a13c6aacdff2bba038475fb", "packets": 23, "transport": "tcp", "last_frame": 1229, "first_frame": 1115, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49724, "responder_port": 49670, "initiator_bytes": 4398, "last_seen_epoch": "1582246466.399262", "responder_bytes": 2421, "first_seen_epoch": "1582246463.994426" }, { "bytes": 7534, "stream": 54, "flow_id": "flow-8ceabdbb131c4429d877ba37", "packets": 21, "transport": "tcp", "last_frame": 1176, "first_frame": 1138, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49725, "responder_port": 389, "initiator_bytes": 3473, "last_seen_epoch": "1582246464.018627", "responder_bytes": 4061, "first_seen_epoch": "1582246464.005691" }, { "bytes": 6948, "stream": 55, "flow_id": "flow-b79883a7e4d4a672d951b275", "packets": 18, "transport": "tcp", "last_frame": 1173, "first_frame": 1155, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49726, "responder_port": 389, "initiator_bytes": 2873, "last_seen_epoch": "1582246464.018246", "responder_bytes": 4075, "first_seen_epoch": "1582246464.013848" }, { "bytes": 375, "stream": 45, "flow_id": "flow-213c246a107a4306ede47783", "packets": 2, "transport": "udp", "last_frame": 1180, "first_frame": 1179, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 52250, "responder_port": 53, "initiator_bytes": 85, "last_seen_epoch": "1582246464.271335", "responder_bytes": 290, "first_seen_epoch": "1582246464.057685" }, { "bytes": 7531, "stream": 56, "flow_id": "flow-c140807770e33500e3f2602e", "packets": 21, "transport": "tcp", "last_frame": 1230, "first_frame": 1181, "initiator_ip": "172.17.8.174", "responder_ip": "40.126.5.35", "initiator_port": 49727, "responder_port": 443, "initiator_bytes": 1539, "last_seen_epoch": "1582246466.39988", "responder_bytes": 5992, "first_seen_epoch": "1582246464.272118" }, { "bytes": 300, "stream": 46, "flow_id": "flow-c8d168ed1b4cb23f7f965f67", "packets": 2, "transport": "udp", "last_frame": 1183, "first_frame": 1182, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61613, "responder_port": 53, "initiator_bytes": 116, "last_seen_epoch": "1582246464.533342", "responder_bytes": 184, "first_seen_epoch": "1582246464.533063" }, { "bytes": 477, "stream": 47, "flow_id": "flow-54cd77972651aa94293dbfed", "packets": 2, "transport": "udp", "last_frame": 1185, "first_frame": 1184, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61614, "responder_port": 389, "initiator_bytes": 233, "last_seen_epoch": "1582246464.534267", "responder_bytes": 244, "first_seen_epoch": "1582246464.533983" }, { "bytes": 6924, "stream": 57, "flow_id": "flow-1a5eb4cacb7e453e7796d290", "packets": 15, "transport": "tcp", "last_frame": 1204, "first_frame": 1190, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49728, "responder_port": 3268, "initiator_bytes": 3166, "last_seen_epoch": "1582246464.675682", "responder_bytes": 3758, "first_seen_epoch": "1582246464.649378" }, { "bytes": 250, "stream": 48, "flow_id": "flow-6f9522b66ce19b6a48330572", "packets": 2, "transport": "udp", "last_frame": 1234, "first_frame": 1233, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 51673, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1582246474.059399", "responder_bytes": 160, "first_seen_epoch": "1582246473.838979" }, { "bytes": 28541, "stream": 58, "flow_id": "flow-bb67c5ac90e746ed0e587d14", "packets": 57, "transport": "tcp", "last_frame": 1309, "first_frame": 1235, "initiator_ip": "172.17.8.174", "responder_ip": "52.114.128.9", "initiator_port": 49729, "responder_port": 443, "initiator_bytes": 21861, "last_seen_epoch": "1582246495.84812", "responder_bytes": 6680, "first_seen_epoch": "1582246474.08012" }, { "bytes": 7032, "stream": 59, "flow_id": "flow-95d1e3df9eff44e6a1c2dee6", "packets": 17, "transport": "tcp", "last_frame": 1330, "first_frame": 1314, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49730, "responder_port": 3268, "initiator_bytes": 3220, "last_seen_epoch": "1582246503.653323", "responder_bytes": 3812, "first_seen_epoch": "1582246503.644355" }, { "bytes": 160, "stream": 49, "flow_id": "flow-862964c51a007d52d8cefeef", "packets": 2, "transport": "udp", "last_frame": 1332, "first_frame": 1331, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62187, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1582246506.447128", "responder_bytes": 88, "first_seen_epoch": "1582246506.138612" }, { "bytes": 221940, "stream": 60, "flow_id": "flow-ebc9ba0db4fc46d28655b090", "packets": 233, "transport": "tcp", "last_frame": 1569, "first_frame": 1333, "initiator_ip": "172.17.8.174", "responder_ip": "49.51.172.56", "initiator_port": 49731, "responder_port": 80, "initiator_bytes": 3430, "last_seen_epoch": "1582246508.625113", "responder_bytes": 218510, "first_seen_epoch": "1582246506.453005" }, { "bytes": 241, "stream": 50, "flow_id": "flow-e7109b6c21d10bd9e828bf8d", "packets": 2, "transport": "udp", "last_frame": 1335, "first_frame": 1334, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54860, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1582246506.556316", "responder_bytes": 160, "first_seen_epoch": "1582246506.55599" }, { "bytes": 227, "stream": 51, "flow_id": "flow-64f4130055f2a2c2f0c23057", "packets": 2, "transport": "udp", "last_frame": 1337, "first_frame": 1336, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49859, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1582246506.55698", "responder_bytes": 151, "first_seen_epoch": "1582246506.556761" }, { "bytes": 574, "stream": 52, "flow_id": "flow-9a92e2b22063a884a0f1f945", "packets": 4, "transport": "udp", "last_frame": 1799, "first_frame": 1570, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49668, "responder_port": 53, "initiator_bytes": 218, "last_seen_epoch": "1582246733.394985", "responder_bytes": 356, "first_seen_epoch": "1582246512.594997" }, { "bytes": 25582, "stream": 61, "flow_id": "flow-21b724ab314f5e2e29e8e1a2", "packets": 51, "transport": "tcp", "last_frame": 1787, "first_frame": 1572, "initiator_ip": "172.17.8.174", "responder_ip": "52.114.76.34", "initiator_port": 49732, "responder_port": 443, "initiator_bytes": 19506, "last_seen_epoch": "1582246622.826267", "responder_bytes": 6076, "first_seen_epoch": "1582246512.751544" }, { "bytes": 324, "stream": 53, "flow_id": "flow-113477d7749d91799f82443c", "packets": 2, "transport": "udp", "last_frame": 1574, "first_frame": 1573, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60530, "responder_port": 53, "initiator_bytes": 128, "last_seen_epoch": "1582246512.935824", "responder_bytes": 196, "first_seen_epoch": "1582246512.935443" }, { "bytes": 513, "stream": 54, "flow_id": "flow-ad648fba6900d7a9f63069ad", "packets": 2, "transport": "udp", "last_frame": 1576, "first_frame": 1575, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60531, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246512.938867", "responder_bytes": 244, "first_seen_epoch": "1582246512.938432" }, { "bytes": 1770, "stream": 62, "flow_id": "flow-0ac73797bc5d6e67a6bfa140", "packets": 11, "transport": "tcp", "last_frame": 1650, "first_frame": 1581, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49733, "responder_port": 135, "initiator_bytes": 898, "last_seen_epoch": "1582246513.138844", "responder_bytes": 872, "first_seen_epoch": "1582246513.070374" }, { "bytes": 6777, "stream": 63, "flow_id": "flow-3f47628848a7c17d14e34067", "packets": 23, "transport": "tcp", "last_frame": 1651, "first_frame": 1588, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49734, "responder_port": 49670, "initiator_bytes": 4356, "last_seen_epoch": "1582246513.141594", "responder_bytes": 2421, "first_seen_epoch": "1582246513.075356" }, { "bytes": 7384, "stream": 64, "flow_id": "flow-95f84b9d93206949f4489fc4", "packets": 19, "transport": "tcp", "last_frame": 1647, "first_frame": 1611, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49735, "responder_port": 389, "initiator_bytes": 3377, "last_seen_epoch": "1582246513.117236", "responder_bytes": 4007, "first_seen_epoch": "1582246513.097124" }, { "bytes": 6906, "stream": 65, "flow_id": "flow-7420b28dccfd69db67b3d4c4", "packets": 18, "transport": "tcp", "last_frame": 1645, "first_frame": 1628, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49736, "responder_port": 389, "initiator_bytes": 2831, "last_seen_epoch": "1582246513.116798", "responder_bytes": 4075, "first_seen_epoch": "1582246513.106892" }, { "bytes": 109, "stream": 66, "flow_id": "flow-94ff650ce3ae8ed41b939811", "packets": 2, "transport": "tcp", "last_frame": 1698, "first_frame": 1697, "initiator_ip": "172.17.8.8", "responder_ip": "172.17.8.174", "initiator_port": 445, "responder_port": 49776, "initiator_bytes": 55, "last_seen_epoch": "1582246531.939921", "responder_bytes": 54, "first_seen_epoch": "1582246531.939506" }, { "bytes": 265, "stream": 55, "flow_id": "flow-eff38595f8cdcffb1bf75d09", "packets": 2, "transport": "udp", "last_frame": 1709, "first_frame": 1708, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 56238, "responder_port": 53, "initiator_bytes": 72, "last_seen_epoch": "1582246560.676996", "responder_bytes": 193, "first_seen_epoch": "1582246560.531193" }, { "bytes": 10981, "stream": 67, "flow_id": "flow-915f0a471cca387242375e04", "packets": 28, "transport": "tcp", "last_frame": 1783, "first_frame": 1710, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.200", "initiator_port": 49737, "responder_port": 443, "initiator_bytes": 3072, "last_seen_epoch": "1582246621.118099", "responder_bytes": 7909, "first_seen_epoch": "1582246560.679036" }, { "bytes": 245, "stream": 56, "flow_id": "flow-3613022f6f96962a14ce565d", "packets": 2, "transport": "udp", "last_frame": 1744, "first_frame": 1741, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60770, "responder_port": 53, "initiator_bytes": 90, "last_seen_epoch": "1582246584.856481", "responder_bytes": 155, "first_seen_epoch": "1582246584.660763" }, { "bytes": 8887, "stream": 68, "flow_id": "flow-b162f3ac1bc52629366d913e", "packets": 22, "transport": "tcp", "last_frame": 1795, "first_frame": 1745, "initiator_ip": "172.17.8.174", "responder_ip": "52.109.124.20", "initiator_port": 49738, "responder_port": 443, "initiator_bytes": 1614, "last_seen_epoch": "1582246695.019046", "responder_bytes": 7273, "first_seen_epoch": "1582246584.857489" }, { "bytes": 513, "stream": 57, "flow_id": "flow-24b0aa1b2581d26df9c66419", "packets": 2, "transport": "udp", "last_frame": 1801, "first_frame": 1800, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49669, "responder_port": 389, "initiator_bytes": 269, "last_seen_epoch": "1582246733.396882", "responder_bytes": 244, "first_seen_epoch": "1582246733.3966" }, { "bytes": 1704, "stream": 69, "flow_id": "flow-22d91c3eeead8264425cb708", "packets": 10, "transport": "tcp", "last_frame": 1871, "first_frame": 1802, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49739, "responder_port": 135, "initiator_bytes": 832, "last_seen_epoch": "1582246733.55892", "responder_bytes": 872, "first_seen_epoch": "1582246733.517769" }, { "bytes": 6711, "stream": 70, "flow_id": "flow-2336f4befd8a0d24d2f81e4b", "packets": 22, "transport": "tcp", "last_frame": 1872, "first_frame": 1809, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49740, "responder_port": 49670, "initiator_bytes": 4290, "last_seen_epoch": "1582246733.559155", "responder_bytes": 2421, "first_seen_epoch": "1582246733.525416" }, { "bytes": 7492, "stream": 71, "flow_id": "flow-77143e055c078bdc7841d3b5", "packets": 21, "transport": "tcp", "last_frame": 1870, "first_frame": 1832, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49741, "responder_port": 389, "initiator_bytes": 3431, "last_seen_epoch": "1582246733.557021", "responder_bytes": 4061, "first_seen_epoch": "1582246733.54768" }, { "bytes": 6906, "stream": 72, "flow_id": "flow-47d05cd32c954540b2ae6f19", "packets": 18, "transport": "tcp", "last_frame": 1866, "first_frame": 1849, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49742, "responder_port": 389, "initiator_bytes": 2831, "last_seen_epoch": "1582246733.556686", "responder_bytes": 4075, "first_seen_epoch": "1582246733.553105" }, { "bytes": 15021, "stream": 73, "flow_id": "flow-d200f31697d826008e2c2d05", "packets": 32, "transport": "tcp", "last_frame": 1934, "first_frame": 1873, "initiator_ip": "172.17.8.174", "responder_ip": "52.114.132.22", "initiator_port": 49743, "responder_port": 443, "initiator_bytes": 7644, "last_seen_epoch": "1582246883.128214", "responder_bytes": 7377, "first_seen_epoch": "1582246763.163222" }, { "bytes": 9462, "stream": 74, "flow_id": "flow-3aef6157139b542bcebcfece", "packets": 29, "transport": "tcp", "last_frame": 2001, "first_frame": 1906, "initiator_ip": "172.17.8.174", "responder_ip": "52.114.76.34", "initiator_port": 49744, "responder_port": 443, "initiator_bytes": 3982, "last_seen_epoch": "1582246979.372881", "responder_bytes": 5480, "first_seen_epoch": "1582246868.867292" }, { "bytes": 270, "stream": 58, "flow_id": "flow-0e844298c651d2569460d18d", "packets": 2, "transport": "udp", "last_frame": 1944, "first_frame": 1940, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61422, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1582246971.561272", "responder_bytes": 188, "first_seen_epoch": "1582246971.35619" }, { "bytes": 310, "stream": 59, "flow_id": "flow-a3e1b800722ac0a04e333e54", "packets": 2, "transport": "udp", "last_frame": 1942, "first_frame": 1941, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 50624, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1582246971.491797", "responder_bytes": 227, "first_seen_epoch": "1582246971.395342" }, { "bytes": 10564, "stream": 75, "flow_id": "flow-51fc6724c4d15ab561183c42", "packets": 29, "transport": "tcp", "last_frame": 1995, "first_frame": 1943, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.246.10", "initiator_port": 49745, "responder_port": 443, "initiator_bytes": 2796, "last_seen_epoch": "1582246972.244919", "responder_bytes": 7768, "first_seen_epoch": "1582246971.494122" }, { "bytes": 7846, "stream": 76, "flow_id": "flow-e55b46ea9ebcca70334ea640", "packets": 25, "transport": "tcp", "last_frame": 1997, "first_frame": 1945, "initiator_ip": "172.17.8.174", "responder_ip": "52.230.222.68", "initiator_port": 49746, "responder_port": 443, "initiator_bytes": 2784, "last_seen_epoch": "1582246972.393494", "responder_bytes": 5062, "first_seen_epoch": "1582246971.564554" }, { "bytes": 270, "stream": 60, "flow_id": "flow-f5308f9eadcbd8bb42a76a29", "packets": 2, "transport": "udp", "last_frame": 2008, "first_frame": 2003, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 63391, "responder_port": 53, "initiator_bytes": 82, "last_seen_epoch": "1582247032.420357", "responder_bytes": 188, "first_seen_epoch": "1582247031.80922" }, { "bytes": 7684, "stream": 77, "flow_id": "flow-2ff2e19c34f78c57f255bc4a", "packets": 25, "transport": "tcp", "last_frame": 2033, "first_frame": 2009, "initiator_ip": "172.17.8.174", "responder_ip": "52.230.222.68", "initiator_port": 49747, "responder_port": 443, "initiator_bytes": 2517, "last_seen_epoch": "1582247033.441767", "responder_bytes": 5167, "first_seen_epoch": "1582247032.421023" }, { "bytes": 255, "stream": 61, "flow_id": "flow-2a9fde44a4c0cbe4337af819", "packets": 2, "transport": "udp", "last_frame": 2036, "first_frame": 2035, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 56715, "responder_port": 53, "initiator_bytes": 86, "last_seen_epoch": "1582247034.931427", "responder_bytes": 169, "first_seen_epoch": "1582247034.747042" }, { "bytes": 40792, "stream": 78, "flow_id": "flow-cac59960bc60c43eea825871", "packets": 84, "transport": "tcp", "last_frame": 2120, "first_frame": 2037, "initiator_ip": "172.17.8.174", "responder_ip": "40.91.116.226", "initiator_port": 49748, "responder_port": 443, "initiator_bytes": 28758, "last_seen_epoch": "1582247036.929827", "responder_bytes": 12034, "first_seen_epoch": "1582247034.9363" }, { "bytes": 273, "stream": 62, "flow_id": "flow-e66dfec67d1cdbaf624868f8", "packets": 2, "transport": "udp", "last_frame": 2122, "first_frame": 2121, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60326, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1582247037.024283", "responder_bytes": 182, "first_seen_epoch": "1582247036.930755" }, { "bytes": 19263, "stream": 79, "flow_id": "flow-b12155fe1949af849b547559", "packets": 48, "transport": "tcp", "last_frame": 2170, "first_frame": 2123, "initiator_ip": "172.17.8.174", "responder_ip": "64.4.54.18", "initiator_port": 49749, "responder_port": 443, "initiator_bytes": 12783, "last_seen_epoch": "1582247038.996126", "responder_bytes": 6480, "first_seen_epoch": "1582247037.024962" }, { "bytes": 241, "stream": 63, "flow_id": "flow-751d8e05a50b6e296be2ae9d", "packets": 2, "transport": "udp", "last_frame": 2176, "first_frame": 2175, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 58048, "responder_port": 53, "initiator_bytes": 81, "last_seen_epoch": "1582247106.569609", "responder_bytes": 160, "first_seen_epoch": "1582247106.569307" }, { "bytes": 227, "stream": 64, "flow_id": "flow-129c2de493bdbe3498a3f3ee", "packets": 2, "transport": "udp", "last_frame": 2178, "first_frame": 2177, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54269, "responder_port": 53, "initiator_bytes": 76, "last_seen_epoch": "1582247106.570166", "responder_bytes": 151, "first_seen_epoch": "1582247106.569997" }, { "bytes": 8840, "stream": 80, "flow_id": "flow-915f50c016ef23ebd0633be6", "packets": 25, "transport": "tcp", "last_frame": 2209, "first_frame": 2185, "initiator_ip": "172.17.8.174", "responder_ip": "52.114.76.34", "initiator_port": 49750, "responder_port": 443, "initiator_bytes": 3468, "last_seen_epoch": "1582247184.362932", "responder_bytes": 5372, "first_seen_epoch": "1582247182.690812" }, { "bytes": 263, "stream": 65, "flow_id": "flow-d8603856209a3021a758306d", "packets": 2, "transport": "udp", "last_frame": 2220, "first_frame": 2218, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 58512, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582247330.055503", "responder_bytes": 171, "first_seen_epoch": "1582247330.055127" }, { "bytes": 320, "stream": 66, "flow_id": "flow-d01317ca546be669330b8de6", "packets": 2, "transport": "udp", "last_frame": 2226, "first_frame": 2222, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62976, "responder_port": 53, "initiator_bytes": 160, "last_seen_epoch": "1582247330.057439", "responder_bytes": 160, "first_seen_epoch": "1582247330.056588" }, { "bytes": 75, "stream": 67, "flow_id": "flow-aae47f32dda46798ee669f68", "packets": 1, "transport": "udp", "last_frame": 2225, "first_frame": 2225, "initiator_ip": "172.17.8.174", "responder_ip": "224.0.0.252", "initiator_port": 60302, "responder_port": 5355, "initiator_bytes": 75, "last_seen_epoch": "1582247330.057241", "responder_bytes": 0, "first_seen_epoch": "1582247330.057241" }, { "bytes": 7207, "stream": 81, "flow_id": "flow-368c92fa9d585816e4e3b314", "packets": 24, "transport": "tcp", "last_frame": 2317, "first_frame": 2229, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49751, "responder_port": 445, "initiator_bytes": 5111, "last_seen_epoch": "1582247343.219587", "responder_bytes": 2096, "first_seen_epoch": "1582247332.479494" }, { "bytes": 273, "stream": 68, "flow_id": "flow-6e1439997a3736eba0f564ce", "packets": 2, "transport": "udp", "last_frame": 2250, "first_frame": 2249, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54051, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1582247334.195082", "responder_bytes": 182, "first_seen_epoch": "1582247333.882191" }, { "bytes": 30009, "stream": 82, "flow_id": "flow-11866b6433dc48bfc18bb8ba", "packets": 62, "transport": "tcp", "last_frame": 2312, "first_frame": 2251, "initiator_ip": "172.17.8.174", "responder_ip": "64.4.54.18", "initiator_port": 49752, "responder_port": 443, "initiator_bytes": 22938, "last_seen_epoch": "1582247338.019822", "responder_bytes": 7071, "first_seen_epoch": "1582247334.196384" }, { "bytes": 373, "stream": 69, "flow_id": "flow-125ebf9db0da788e1155a994", "packets": 4, "transport": "udp", "last_frame": 3149, "first_frame": 2318, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 55694, "responder_port": 53, "initiator_bytes": 243, "last_seen_epoch": "1582247357.668186", "responder_bytes": 130, "first_seen_epoch": "1582247353.836174" }, { "bytes": 251, "stream": 70, "flow_id": "flow-c627ecb3f3d73204b07afe7e", "packets": 2, "transport": "udp", "last_frame": 2320, "first_frame": 2319, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 57672, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582247354.748161", "responder_bytes": 159, "first_seen_epoch": "1582247354.647613" }, { "bytes": 16750, "stream": 83, "flow_id": "flow-beb8c6d68e979a1157c5eafb", "packets": 30, "transport": "tcp", "last_frame": 4406, "first_frame": 2321, "initiator_ip": "172.17.8.174", "responder_ip": "52.109.2.55", "initiator_port": 49753, "responder_port": 443, "initiator_bytes": 4411, "last_seen_epoch": "1582247394.016873", "responder_bytes": 12339, "first_seen_epoch": "1582247354.753501" }, { "bytes": 378, "stream": 71, "flow_id": "flow-2cafc207f987343fc5f1b363", "packets": 2, "transport": "udp", "last_frame": 2353, "first_frame": 2351, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 60181, "responder_port": 53, "initiator_bytes": 83, "last_seen_epoch": "1582247355.864518", "responder_bytes": 295, "first_seen_epoch": "1582247355.766165" }, { "bytes": 1877668, "stream": 84, "flow_id": "flow-4aa5501d468d84685284a521", "packets": 1805, "transport": "tcp", "last_frame": 4407, "first_frame": 2354, "initiator_ip": "172.17.8.174", "responder_ip": "23.54.20.119", "initiator_port": 49754, "responder_port": 443, "initiator_bytes": 21664, "last_seen_epoch": "1582247394.01723", "responder_bytes": 1856004, "first_seen_epoch": "1582247355.879843" }, { "bytes": 30794, "stream": 85, "flow_id": "flow-cfb7e51f1ce2a814ea2834b8", "packets": 42, "transport": "tcp", "last_frame": 3818, "first_frame": 3150, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.128", "initiator_port": 49755, "responder_port": 443, "initiator_bytes": 1721, "last_seen_epoch": "1582247358.339888", "responder_bytes": 29073, "first_seen_epoch": "1582247357.675962" }, { "bytes": 30964, "stream": 86, "flow_id": "flow-296da53a5bcac389d7876632", "packets": 40, "transport": "tcp", "last_frame": 4408, "first_frame": 3151, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.128", "initiator_port": 49756, "responder_port": 443, "initiator_bytes": 1667, "last_seen_epoch": "1582247394.017391", "responder_bytes": 29297, "first_seen_epoch": "1582247357.676244" }, { "bytes": 51398, "stream": 87, "flow_id": "flow-b908ef9b137c7ee92e44e297", "packets": 63, "transport": "tcp", "last_frame": 4409, "first_frame": 3152, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.128", "initiator_port": 49757, "responder_port": 443, "initiator_bytes": 2013, "last_seen_epoch": "1582247394.017498", "responder_bytes": 49385, "first_seen_epoch": "1582247357.676392" }, { "bytes": 39610, "stream": 88, "flow_id": "flow-98635c35ad6ef3a4416c2e00", "packets": 49, "transport": "tcp", "last_frame": 4410, "first_frame": 3153, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.128", "initiator_port": 49758, "responder_port": 443, "initiator_bytes": 1745, "last_seen_epoch": "1582247394.017653", "responder_bytes": 37865, "first_seen_epoch": "1582247357.676522" }, { "bytes": 41960, "stream": 89, "flow_id": "flow-bf8e2d4b1d68eaf335bf3452", "packets": 55, "transport": "tcp", "last_frame": 4411, "first_frame": 3154, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.128", "initiator_port": 49759, "responder_port": 443, "initiator_bytes": 1917, "last_seen_epoch": "1582247394.017845", "responder_bytes": 40043, "first_seen_epoch": "1582247357.676649" }, { "bytes": 6213, "stream": 90, "flow_id": "flow-57fe6f8e6fd9555cd4514716", "packets": 21, "transport": "tcp", "last_frame": 4468, "first_frame": 4419, "initiator_ip": "172.17.8.174", "responder_ip": "91.211.88.122", "initiator_port": 49760, "responder_port": 443, "initiator_bytes": 3603, "last_seen_epoch": "1582247510.275827", "responder_bytes": 2610, "first_seen_epoch": "1582247508.283452" }, { "bytes": 213, "stream": 72, "flow_id": "flow-dcfdee00d659ce89e4e6d2ea", "packets": 2, "transport": "udp", "last_frame": 4437, "first_frame": 4436, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 50399, "responder_port": 53, "initiator_bytes": 73, "last_seen_epoch": "1582247509.81144", "responder_bytes": 140, "first_seen_epoch": "1582247509.660085" }, { "bytes": 10403, "stream": 91, "flow_id": "flow-1efc0d975ea5760438221c82", "packets": 32, "transport": "tcp", "last_frame": 5522, "first_frame": 4438, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.222", "initiator_port": 49761, "responder_port": 443, "initiator_bytes": 1986, "last_seen_epoch": "1582247639.431212", "responder_bytes": 8417, "first_seen_epoch": "1582247509.813341" }, { "bytes": 12040, "stream": 92, "flow_id": "flow-1a7492dd26b3cd93f61d4250", "packets": 36, "transport": "tcp", "last_frame": 5509, "first_frame": 4469, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.200", "initiator_port": 49762, "responder_port": 443, "initiator_bytes": 5032, "last_seen_epoch": "1582247531.058977", "responder_bytes": 7008, "first_seen_epoch": "1582247510.365661" }, { "bytes": 810757, "stream": 93, "flow_id": "flow-e06080f2e9700ccdc32652ca", "packets": 836, "transport": "tcp", "last_frame": 5431, "first_frame": 4497, "initiator_ip": "172.17.8.174", "responder_ip": "91.211.88.122", "initiator_port": 49763, "responder_port": 443, "initiator_bytes": 12012, "last_seen_epoch": "1582247515.001793", "responder_bytes": 798745, "first_seen_epoch": "1582247511.291892" }, { "bytes": 8142, "stream": 94, "flow_id": "flow-583186b05ef6fd267a272aa3", "packets": 29, "transport": "tcp", "last_frame": 5521, "first_frame": 4506, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.3.254", "initiator_port": 49764, "responder_port": 443, "initiator_bytes": 1891, "last_seen_epoch": "1582247638.864871", "responder_bytes": 6251, "first_seen_epoch": "1582247512.247163" }, { "bytes": 225, "stream": 73, "flow_id": "flow-3b2225fc20df38f50f53bc36", "packets": 2, "transport": "udp", "last_frame": 4541, "first_frame": 4540, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54226, "responder_port": 53, "initiator_bytes": 79, "last_seen_epoch": "1582247513.062427", "responder_bytes": 146, "first_seen_epoch": "1582247512.934284" }, { "bytes": 10830, "stream": 95, "flow_id": "flow-888176c5f5c320fdaf2fc64b", "packets": 33, "transport": "tcp", "last_frame": 4665, "first_frame": 4542, "initiator_ip": "172.17.8.174", "responder_ip": "72.21.81.200", "initiator_port": 49765, "responder_port": 443, "initiator_bytes": 1683, "last_seen_epoch": "1582247513.703195", "responder_bytes": 9147, "first_seen_epoch": "1582247513.063354" }, { "bytes": 221, "stream": 74, "flow_id": "flow-205881a2bbc30c7c8104ee7a", "packets": 2, "transport": "udp", "last_frame": 4671, "first_frame": 4666, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61871, "responder_port": 53, "initiator_bytes": 77, "last_seen_epoch": "1582247513.802766", "responder_bytes": 144, "first_seen_epoch": "1582247513.709545" }, { "bytes": 8131, "stream": 96, "flow_id": "flow-ae2a105ca8cc284aabe25f29", "packets": 29, "transport": "tcp", "last_frame": 5520, "first_frame": 4672, "initiator_ip": "172.17.8.174", "responder_ip": "204.79.197.254", "initiator_port": 49766, "responder_port": 443, "initiator_bytes": 1600, "last_seen_epoch": "1582247636.888939", "responder_bytes": 6531, "first_seen_epoch": "1582247513.803818" }, { "bytes": 3210, "stream": 97, "flow_id": "flow-e17bf97d97aee04b95616565", "packets": 17, "transport": "tcp", "last_frame": 5448, "first_frame": 5432, "initiator_ip": "172.17.8.174", "responder_ip": "91.211.88.122", "initiator_port": 49767, "responder_port": 443, "initiator_bytes": 996, "last_seen_epoch": "1582247517.619573", "responder_bytes": 2214, "first_seen_epoch": "1582247516.055365" }, { "bytes": 1388, "stream": 98, "flow_id": "flow-52b61f47e51eec6821bc92eb", "packets": 12, "transport": "tcp", "last_frame": 5500, "first_frame": 5449, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49768, "responder_port": 135, "initiator_bytes": 730, "last_seen_epoch": "1582247529.461022", "responder_bytes": 658, "first_seen_epoch": "1582247517.629864" }, { "bytes": 1660, "stream": 99, "flow_id": "flow-4fdef7eec472efa6d7101ace", "packets": 12, "transport": "tcp", "last_frame": 5501, "first_frame": 5456, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 49769, "responder_port": 49670, "initiator_bytes": 890, "last_seen_epoch": "1582247529.461178", "responder_bytes": 770, "first_seen_epoch": "1582247517.632393" }, { "bytes": 3318, "stream": 100, "flow_id": "flow-6e923cf20a8f9d3d72a7b718", "packets": 19, "transport": "tcp", "last_frame": 5493, "first_frame": 5475, "initiator_ip": "172.17.8.174", "responder_ip": "91.211.88.122", "initiator_port": 49770, "responder_port": 443, "initiator_bytes": 1050, "last_seen_epoch": "1582247524.493527", "responder_bytes": 2268, "first_seen_epoch": "1582247522.748482" }, { "bytes": 453, "stream": 75, "flow_id": "flow-7e26e6c6e52f185968a22c4a", "packets": 4, "transport": "udp", "last_frame": 5526, "first_frame": 5523, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 50909, "responder_port": 53, "initiator_bytes": 300, "last_seen_epoch": "1582247641.9658", "responder_bytes": 153, "first_seen_epoch": "1582247640.723717" }, { "bytes": 9912, "stream": 101, "flow_id": "flow-2bddcef8d7b3ae4cf5747027", "packets": 32, "transport": "tcp", "last_frame": 5559, "first_frame": 5527, "initiator_ip": "172.17.8.174", "responder_ip": "52.159.17.76", "initiator_port": 49771, "responder_port": 443, "initiator_bytes": 3343, "last_seen_epoch": "1582247642.810366", "responder_bytes": 6569, "first_seen_epoch": "1582247641.966916" }, { "bytes": 14137, "stream": 102, "flow_id": "flow-afac80993318279ffe847cf3", "packets": 37, "transport": "tcp", "last_frame": 5596, "first_frame": 5557, "initiator_ip": "172.17.8.174", "responder_ip": "52.159.17.76", "initiator_port": 49772, "responder_port": 443, "initiator_bytes": 6186, "last_seen_epoch": "1582247643.547621", "responder_bytes": 7951, "first_seen_epoch": "1582247642.756443" }, { "bytes": 15718, "stream": 103, "flow_id": "flow-16517cca0842fcb7c4f2cb56", "packets": 38, "transport": "tcp", "last_frame": 5633, "first_frame": 5594, "initiator_ip": "172.17.8.174", "responder_ip": "52.159.17.76", "initiator_port": 49773, "responder_port": 443, "initiator_bytes": 7280, "last_seen_epoch": "1582247644.386213", "responder_bytes": 8438, "first_seen_epoch": "1582247643.538717" }, { "bytes": 306, "stream": 76, "flow_id": "flow-7f486e3d077ab2a4ab0df43f", "packets": 2, "transport": "udp", "last_frame": 5635, "first_frame": 5634, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 57395, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582247644.559781", "responder_bytes": 214, "first_seen_epoch": "1582247644.47712" }, { "bytes": 5008, "stream": 104, "flow_id": "flow-6faf7d744c088a2e95124a1b", "packets": 24, "transport": "tcp", "last_frame": 5666, "first_frame": 5636, "initiator_ip": "172.17.8.174", "responder_ip": "40.69.216.73", "initiator_port": 49774, "responder_port": 443, "initiator_bytes": 1215, "last_seen_epoch": "1582247646.129654", "responder_bytes": 3793, "first_seen_epoch": "1582247644.56405" }, { "bytes": 352, "stream": 77, "flow_id": "flow-54c8ee7f1340425618b5421e", "packets": 2, "transport": "udp", "last_frame": 5659, "first_frame": 5658, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 53951, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1582247646.003943", "responder_bytes": 258, "first_seen_epoch": "1582247645.910395" }, { "bytes": 9456, "stream": 105, "flow_id": "flow-072d8fedc8260aa36c360bb6", "packets": 22, "transport": "tcp", "last_frame": 5683, "first_frame": 5660, "initiator_ip": "172.17.8.174", "responder_ip": "104.77.69.193", "initiator_port": 49775, "responder_port": 443, "initiator_bytes": 1170, "last_seen_epoch": "1582247646.572384", "responder_bytes": 8286, "first_seen_epoch": "1582247646.005288" }, { "bytes": 352, "stream": 78, "flow_id": "flow-2c84e35e8a011d86ac498442", "packets": 2, "transport": "udp", "last_frame": 5685, "first_frame": 5684, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 50558, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1582247646.674447", "responder_bytes": 258, "first_seen_epoch": "1582247646.578807" }, { "bytes": 8894, "stream": 106, "flow_id": "flow-d6df2e6463b4ab51101abd1f", "packets": 22, "transport": "tcp", "last_frame": 5738, "first_frame": 5686, "initiator_ip": "172.17.8.174", "responder_ip": "104.77.69.193", "initiator_port": 49776, "responder_port": 443, "initiator_bytes": 1378, "last_seen_epoch": "1582247647.2919", "responder_bytes": 7516, "first_seen_epoch": "1582247646.675587" }, { "bytes": 273, "stream": 79, "flow_id": "flow-281835b5b8a267bd551165f1", "packets": 2, "transport": "udp", "last_frame": 5692, "first_frame": 5687, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 61650, "responder_port": 53, "initiator_bytes": 91, "last_seen_epoch": "1582247646.788647", "responder_bytes": 182, "first_seen_epoch": "1582247646.68731" }, { "bytes": 11777, "stream": 107, "flow_id": "flow-296ba6b29ee0cd887a594d48", "packets": 36, "transport": "tcp", "last_frame": 5781, "first_frame": 5693, "initiator_ip": "172.17.8.174", "responder_ip": "64.4.54.18", "initiator_port": 49777, "responder_port": 443, "initiator_bytes": 6115, "last_seen_epoch": "1582247647.615774", "responder_bytes": 5662, "first_seen_epoch": "1582247646.789717" }, { "bytes": 9002, "stream": 108, "flow_id": "flow-c8477c66a4a773f70ae8d37b", "packets": 24, "transport": "tcp", "last_frame": 5795, "first_frame": 5718, "initiator_ip": "172.17.8.174", "responder_ip": "104.77.69.193", "initiator_port": 49778, "responder_port": 443, "initiator_bytes": 1433, "last_seen_epoch": "1582247647.753325", "responder_bytes": 7569, "first_seen_epoch": "1582247647.202165" }, { "bytes": 331, "stream": 80, "flow_id": "flow-f252f75355b55e6a4830c891", "packets": 2, "transport": "udp", "last_frame": 5742, "first_frame": 5719, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 62300, "responder_port": 53, "initiator_bytes": 88, "last_seen_epoch": "1582247647.303609", "responder_bytes": 243, "first_seen_epoch": "1582247647.209505" }, { "bytes": 2014, "stream": 109, "flow_id": "flow-4840b83c9492f9c933704fec", "packets": 10, "transport": "tcp", "last_frame": 5775, "first_frame": 5743, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.4.50", "initiator_port": 49779, "responder_port": 80, "initiator_bytes": 595, "last_seen_epoch": "1582247647.57969", "responder_bytes": 1419, "first_seen_epoch": "1582247647.304258" }, { "bytes": 426, "stream": 81, "flow_id": "flow-7e9ddb82ab89947e3664a932", "packets": 2, "transport": "udp", "last_frame": 5776, "first_frame": 5770, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 52862, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1582247647.592563", "responder_bytes": 332, "first_seen_epoch": "1582247647.504799" }, { "bytes": 178, "stream": 110, "flow_id": "flow-f44534aae8ae605d4644ef80", "packets": 3, "transport": "tcp", "last_frame": 5786, "first_frame": 5777, "initiator_ip": "172.17.8.174", "responder_ip": "23.1.236.125", "initiator_port": 49780, "responder_port": 80, "initiator_bytes": 120, "last_seen_epoch": "1582247647.680939", "responder_bytes": 58, "first_seen_epoch": "1582247647.598498" }, { "bytes": 178, "stream": 111, "flow_id": "flow-3c48a8e374d33bde5eabd7ef", "packets": 3, "transport": "tcp", "last_frame": 5788, "first_frame": 5778, "initiator_ip": "172.17.8.174", "responder_ip": "23.1.236.85", "initiator_port": 49781, "responder_port": 80, "initiator_bytes": 120, "last_seen_epoch": "1582247647.694701", "responder_bytes": 58, "first_seen_epoch": "1582247647.59897" }, { "bytes": 293, "stream": 82, "flow_id": "flow-f88f41f2ba5806c0f7f5c5de", "packets": 2, "transport": "udp", "last_frame": 5789, "first_frame": 5779, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 54930, "responder_port": 53, "initiator_bytes": 92, "last_seen_epoch": "1582247647.697828", "responder_bytes": 201, "first_seen_epoch": "1582247647.604485" }, { "bytes": 1154, "stream": 112, "flow_id": "flow-9e00280f40341755566566c0", "packets": 9, "transport": "tcp", "last_frame": 5827, "first_frame": 5790, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49782, "responder_port": 80, "initiator_bytes": 704, "last_seen_epoch": "1582247647.90727", "responder_bytes": 450, "first_seen_epoch": "1582247647.703418" }, { "bytes": 1154, "stream": 113, "flow_id": "flow-e8e7fdf1ade39213f6ea21a6", "packets": 9, "transport": "tcp", "last_frame": 5829, "first_frame": 5791, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49783, "responder_port": 80, "initiator_bytes": 704, "last_seen_epoch": "1582247647.907674", "responder_bytes": 450, "first_seen_epoch": "1582247647.703704" }, { "bytes": 1205, "stream": 114, "flow_id": "flow-50962aed8b2546917649ce45", "packets": 10, "transport": "tcp", "last_frame": 5823, "first_frame": 5792, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49784, "responder_port": 80, "initiator_bytes": 701, "last_seen_epoch": "1582247647.902454", "responder_bytes": 504, "first_seen_epoch": "1582247647.706864" }, { "bytes": 1205, "stream": 115, "flow_id": "flow-a8a9ee98329b3a63398cb8e5", "packets": 10, "transport": "tcp", "last_frame": 5825, "first_frame": 5793, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49785, "responder_port": 80, "initiator_bytes": 701, "last_seen_epoch": "1582247647.903116", "responder_bytes": 504, "first_seen_epoch": "1582247647.707121" }, { "bytes": 11758, "stream": 116, "flow_id": "flow-0f7778d89704438b86da17ff", "packets": 35, "transport": "tcp", "last_frame": 5873, "first_frame": 5830, "initiator_ip": "172.17.8.174", "responder_ip": "64.4.54.18", "initiator_port": 49786, "responder_port": 443, "initiator_bytes": 6114, "last_seen_epoch": "1582247648.845076", "responder_bytes": 5644, "first_seen_epoch": "1582247648.023346" }, { "bytes": 551549, "stream": 117, "flow_id": "flow-0729d765b8095b2f280fad27", "packets": 561, "transport": "tcp", "last_frame": 6655, "first_frame": 5863, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49787, "responder_port": 80, "initiator_bytes": 8160, "last_seen_epoch": "1582247649.464319", "responder_bytes": 543389, "first_seen_epoch": "1582247648.739091" }, { "bytes": 1190, "stream": 118, "flow_id": "flow-eba395a0132bf474907204b2", "packets": 7, "transport": "tcp", "last_frame": 5899, "first_frame": 5864, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49788, "responder_port": 80, "initiator_bytes": 651, "last_seen_epoch": "1582247649.023776", "responder_bytes": 539, "first_seen_epoch": "1582247648.739933" }, { "bytes": 1185, "stream": 119, "flow_id": "flow-aff67ed0068bac658528c010", "packets": 7, "transport": "tcp", "last_frame": 5898, "first_frame": 5865, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49789, "responder_port": 80, "initiator_bytes": 646, "last_seen_epoch": "1582247649.023741", "responder_bytes": 539, "first_seen_epoch": "1582247648.765835" }, { "bytes": 841452, "stream": 120, "flow_id": "flow-04f017890b92c973ce3f322b", "packets": 897, "transport": "tcp", "last_frame": 7397, "first_frame": 5866, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49790, "responder_port": 80, "initiator_bytes": 13982, "last_seen_epoch": "1582247649.805111", "responder_bytes": 827470, "first_seen_epoch": "1582247648.766849" }, { "bytes": 8893, "stream": 121, "flow_id": "flow-8b5c556844daa4eb26de59c7", "packets": 22, "transport": "tcp", "last_frame": 6539, "first_frame": 5867, "initiator_ip": "172.17.8.174", "responder_ip": "104.77.69.193", "initiator_port": 49791, "responder_port": 443, "initiator_bytes": 1378, "last_seen_epoch": "1582247649.444116", "responder_bytes": 7515, "first_seen_epoch": "1582247648.839054" }, { "bytes": 1916, "stream": 122, "flow_id": "flow-2b422ff41b33cdc1b031b173", "packets": 10, "transport": "tcp", "last_frame": 7026, "first_frame": 6265, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.4.50", "initiator_port": 49792, "responder_port": 80, "initiator_bytes": 595, "last_seen_epoch": "1582247649.675189", "responder_bytes": 1321, "first_seen_epoch": "1582247649.335927" }, { "bytes": 8893, "stream": 123, "flow_id": "flow-dad29edae4478a61784acad5", "packets": 22, "transport": "tcp", "last_frame": 7407, "first_frame": 6266, "initiator_ip": "172.17.8.174", "responder_ip": "104.77.69.193", "initiator_port": 49793, "responder_port": 443, "initiator_bytes": 1378, "last_seen_epoch": "1582247649.95331", "responder_bytes": 7515, "first_seen_epoch": "1582247649.336566" }, { "bytes": 1398, "stream": 124, "flow_id": "flow-97634627cff58b25cd36114b", "packets": 11, "transport": "tcp", "last_frame": 8980, "first_frame": 6800, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49794, "responder_port": 80, "initiator_bytes": 752, "last_seen_epoch": "1582247651.632829", "responder_bytes": 646, "first_seen_epoch": "1582247649.577831" }, { "bytes": 669968, "stream": 125, "flow_id": "flow-6e371a956100d8355ed562b4", "packets": 715, "transport": "tcp", "last_frame": 8978, "first_frame": 6811, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49795, "responder_port": 80, "initiator_bytes": 11325, "last_seen_epoch": "1582247651.632752", "responder_bytes": 658643, "first_seen_epoch": "1582247649.579398" }, { "bytes": 3159, "stream": 126, "flow_id": "flow-029723fd833bf161864da2f7", "packets": 12, "transport": "tcp", "last_frame": 7638, "first_frame": 7404, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.4.50", "initiator_port": 49796, "responder_port": 80, "initiator_bytes": 649, "last_seen_epoch": "1582247650.212195", "responder_bytes": 2510, "first_seen_epoch": "1582247649.854494" }, { "bytes": 1402, "stream": 127, "flow_id": "flow-bab061d8d4544ad5e959ea7a", "packets": 11, "transport": "tcp", "last_frame": 8934, "first_frame": 7560, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49797, "responder_port": 80, "initiator_bytes": 754, "last_seen_epoch": "1582247651.373277", "responder_bytes": 648, "first_seen_epoch": "1582247650.084738" }, { "bytes": 702884, "stream": 128, "flow_id": "flow-de66d71933a0bdae76384fcb", "packets": 773, "transport": "tcp", "last_frame": 8932, "first_frame": 7561, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49798, "responder_port": 80, "initiator_bytes": 13066, "last_seen_epoch": "1582247651.364779", "responder_bytes": 689818, "first_seen_epoch": "1582247650.085415" }, { "bytes": 9002, "stream": 129, "flow_id": "flow-0643057e82827e3c02d1eb98", "packets": 24, "transport": "tcp", "last_frame": 8930, "first_frame": 8311, "initiator_ip": "172.17.8.174", "responder_ip": "104.77.69.193", "initiator_port": 49799, "responder_port": 443, "initiator_bytes": 1432, "last_seen_epoch": "1582247651.336321", "responder_bytes": 7570, "first_seen_epoch": "1582247650.704529" }, { "bytes": 2969, "stream": 130, "flow_id": "flow-9e40170f4b8ec92868318239", "packets": 12, "transport": "tcp", "last_frame": 8956, "first_frame": 8919, "initiator_ip": "172.17.8.174", "responder_ip": "13.107.4.50", "initiator_port": 49800, "responder_port": 80, "initiator_bytes": 648, "last_seen_epoch": "1582247651.530229", "responder_bytes": 2321, "first_seen_epoch": "1582247651.234313" }, { "bytes": 303, "stream": 83, "flow_id": "flow-3d5c1492a669f606567936f1", "packets": 2, "transport": "udp", "last_frame": 8935, "first_frame": 8924, "initiator_ip": "172.17.8.174", "responder_ip": "172.17.8.8", "initiator_port": 51627, "responder_port": 53, "initiator_bytes": 94, "last_seen_epoch": "1582247651.373628", "responder_bytes": 209, "first_seen_epoch": "1582247651.264426" }, { "bytes": 1348, "stream": 131, "flow_id": "flow-705d8ce84f4681a514ed3214", "packets": 10, "transport": "tcp", "last_frame": 8975, "first_frame": 8936, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49801, "responder_port": 80, "initiator_bytes": 700, "last_seen_epoch": "1582247651.590085", "responder_bytes": 648, "first_seen_epoch": "1582247651.381657" }, { "bytes": 1186, "stream": 132, "flow_id": "flow-92b15b2f24e0311363e6c013", "packets": 7, "transport": "tcp", "last_frame": 8979, "first_frame": 8937, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49802, "responder_port": 80, "initiator_bytes": 646, "last_seen_epoch": "1582247651.63279", "responder_bytes": 540, "first_seen_epoch": "1582247651.382613" }, { "bytes": 1151, "stream": 133, "flow_id": "flow-f18320589e30b1f4aa7277bc", "packets": 9, "transport": "tcp", "last_frame": 8996, "first_frame": 8943, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.10", "initiator_port": 49803, "responder_port": 80, "initiator_bytes": 701, "last_seen_epoch": "1582247651.643839", "responder_bytes": 450, "first_seen_epoch": "1582247651.449308" }, { "bytes": 1151, "stream": 134, "flow_id": "flow-15d543db555addf9804219fc", "packets": 9, "transport": "tcp", "last_frame": 8994, "first_frame": 8944, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49804, "responder_port": 80, "initiator_bytes": 701, "last_seen_epoch": "1582247651.643273", "responder_bytes": 450, "first_seen_epoch": "1582247651.449443" }, { "bytes": 1805, "stream": 135, "flow_id": "flow-25ebbae366ea82d90a4e8236", "packets": 7, "transport": "tcp", "last_frame": 9006, "first_frame": 8967, "initiator_ip": "172.17.8.174", "responder_ip": "23.1.236.114", "initiator_port": 49805, "responder_port": 80, "initiator_bytes": 646, "last_seen_epoch": "1582247651.77382", "responder_bytes": 1159, "first_seen_epoch": "1582247651.552914" }, { "bytes": 186486, "stream": 136, "flow_id": "flow-4d5b705612769d8c5bf50e52", "packets": 190, "transport": "tcp", "last_frame": 9595, "first_frame": 8968, "initiator_ip": "172.17.8.174", "responder_ip": "23.1.236.92", "initiator_port": 49806, "responder_port": 80, "initiator_bytes": 3229, "last_seen_epoch": "1582247652.11866", "responder_bytes": 183257, "first_seen_epoch": "1582247651.553678" }, { "bytes": 523304, "stream": 137, "flow_id": "flow-8b2a3ef24b42140d45fd01d6", "packets": 494, "transport": "tcp", "last_frame": 9698, "first_frame": 8972, "initiator_ip": "172.17.8.174", "responder_ip": "205.185.216.42", "initiator_port": 49807, "responder_port": 80, "initiator_bytes": 5412, "last_seen_epoch": "1582247652.153841", "responder_bytes": 517892, "first_seen_epoch": "1582247651.58477" }, { "bytes": 9141, "stream": 138, "flow_id": "flow-5a3eedad85a75504212bc9f2", "packets": 22, "transport": "tcp", "last_frame": 9693, "first_frame": 9005, "initiator_ip": "172.17.8.174", "responder_ip": "64.4.54.18", "initiator_port": 49808, "responder_port": 443, "initiator_bytes": 5776, "last_seen_epoch": "1582247652.153441", "responder_bytes": 3365, "first_seen_epoch": "1582247651.743801" } ], "events": { "dns": [ { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-32cbb0841f853dc47f67b105", "src_port": 64898, "tcp_stream": null, "udp_stream": 4, "frame_number": 9, "timestamp_epoch": "1582246431.131746000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 64898, "event_id": "evt-0847ffc42802cb7bf646fd2e", "src_port": 53, "tcp_stream": null, "udp_stream": 4, "frame_number": 10, "timestamp_epoch": "1582246431.132004000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "One-Hot-Mess-DC.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-0549ea154c43aa38824f5922", "src_port": 62494, "tcp_stream": null, "udp_stream": 5, "frame_number": 11, "timestamp_epoch": "1582246431.141151000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "One-Hot-Mess-DC.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62494, "event_id": "evt-0145841c29b436b7bc36c872", "src_port": 53, "tcp_stream": null, "udp_stream": 5, "frame_number": 12, "timestamp_epoch": "1582246431.141527000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-be42ed0ad2eecac5ca839054", "src_port": 63374, "tcp_stream": null, "udp_stream": 7, "frame_number": 15, "timestamp_epoch": "1582246431.240373000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 63374, "event_id": "evt-37bb291f2972e65018a0501a", "src_port": 53, "tcp_stream": null, "udp_stream": 7, "frame_number": 16, "timestamp_epoch": "1582246431.240993000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-682bc27d8288646a08cf1f34", "src_port": 49614, "tcp_stream": null, "udp_stream": 8, "frame_number": 17, "timestamp_epoch": "1582246431.246455000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "_ldap._tcp.dc._msdcs.localdomain.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 49614, "event_id": "evt-10038373ab546e3c8d330c11", "src_port": 53, "tcp_stream": null, "udp_stream": 8, "frame_number": 18, "timestamp_epoch": "1582246431.246862000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-fda9aec33c44d0062337935e", "src_port": 50066, "tcp_stream": null, "udp_stream": 9, "frame_number": 26, "timestamp_epoch": "1582246431.364587000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-2201cc0ce07007d2aab28f74", "src_port": 58724, "tcp_stream": null, "udp_stream": 10, "frame_number": 27, "timestamp_epoch": "1582246431.534875000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 58724, "event_id": "evt-56e25a95736edee8208124de", "src_port": 53, "tcp_stream": null, "udp_stream": 10, "frame_number": 28, "timestamp_epoch": "1582246431.535139000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-3339d1bed161cb2104bebe0e", "src_port": 55851, "tcp_stream": null, "udp_stream": 11, "frame_number": 29, "timestamp_epoch": "1582246431.541544000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 55851, "event_id": "evt-1b2ceb7448efbaade18c5099", "src_port": 53, "tcp_stream": null, "udp_stream": 11, "frame_number": 30, "timestamp_epoch": "1582246431.541833000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "131.107.255.255", "dns.qry.name": "dns.msftncsi.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 50066, "event_id": "evt-d96396bde57d71ce5fbcce12", "src_port": 53, "tcp_stream": null, "udp_stream": 9, "frame_number": 31, "timestamp_epoch": "1582246431.554751000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-e117e6fdf12623c6691cdaef", "src_port": 61942, "tcp_stream": null, "udp_stream": 14, "frame_number": 36, "timestamp_epoch": "1582246432.227241000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 61942, "event_id": "evt-ae03e37e1ba188ed452430de", "src_port": 53, "tcp_stream": null, "udp_stream": 14, "frame_number": 37, "timestamp_epoch": "1582246432.227512000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-4f89bcdbbd117a31d367f8f8", "src_port": 59398, "tcp_stream": null, "udp_stream": 17, "frame_number": 42, "timestamp_epoch": "1582246432.289334000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 59398, "event_id": "evt-a41f19e11aa7ca75f5cb1a11", "src_port": 53, "tcp_stream": null, "udp_stream": 17, "frame_number": 43, "timestamp_epoch": "1582246432.289581000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-73821aef42ef103b692cbcb1", "src_port": 63275, "tcp_stream": null, "udp_stream": 20, "frame_number": 211, "timestamp_epoch": "1582246432.419782000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.DomainDnsZones.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 63275, "event_id": "evt-6a9c979cedae2e8b85713b1d", "src_port": 53, "tcp_stream": null, "udp_stream": 20, "frame_number": 213, "timestamp_epoch": "1582246432.419998000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-452f5493d34a3a4097997f39", "src_port": 58981, "tcp_stream": null, "udp_stream": 22, "frame_number": 265, "timestamp_epoch": "1582246432.537388000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.ForestDnsZones.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 58981, "event_id": "evt-4c39d2c649f501165dc10fe6", "src_port": 53, "tcp_stream": null, "udp_stream": 22, "frame_number": 266, "timestamp_epoch": "1582246432.537530000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-3b6c37ad0d717dd13f795ee5", "src_port": 62862, "tcp_stream": null, "udp_stream": 24, "frame_number": 278, "timestamp_epoch": "1582246432.653590000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62862, "event_id": "evt-7016ace61a547b39c79c5661", "src_port": 53, "tcp_stream": null, "udp_stream": 24, "frame_number": 280, "timestamp_epoch": "1582246432.653831000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "One-Hot-Mess-DC.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-8755532c78a5b1f679fabed2", "src_port": 63487, "tcp_stream": null, "udp_stream": 26, "frame_number": 301, "timestamp_epoch": "1582246432.718664000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "One-Hot-Mess-DC.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 63487, "event_id": "evt-e09f7b13b3155e55d75a654b", "src_port": 53, "tcp_stream": null, "udp_stream": 26, "frame_number": 302, "timestamp_epoch": "1582246432.718966000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-f7a66b51f260c03443397820", "src_port": 60761, "tcp_stream": null, "udp_stream": 27, "frame_number": 516, "timestamp_epoch": "1582246434.315409000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 60761, "event_id": "evt-ee434bf50df8b090aef9cf06", "src_port": 53, "tcp_stream": null, "udp_stream": 27, "frame_number": 517, "timestamp_epoch": "1582246434.315645000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "DESKTOP-TZMKHKC.one-hot-mess.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-48728c5a87748c569c764a60", "src_port": 62148, "tcp_stream": null, "udp_stream": 29, "frame_number": 596, "timestamp_epoch": "1582246435.851831000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "DESKTOP-TZMKHKC.one-hot-mess.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62148, "event_id": "evt-52ef7cf289be64c499599882", "src_port": 53, "tcp_stream": null, "udp_stream": 29, "frame_number": 597, "timestamp_epoch": "1582246435.852236000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.a": "172.17.8.174", "dns.qry.name": "one-hot-mess.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-71a02b651bc3b59a1de37fb8", "src_port": 62362, "tcp_stream": null, "udp_stream": 30, "frame_number": 598, "timestamp_epoch": "1582246435.853954000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.174", "dns.qry.name": "one-hot-mess.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62362, "event_id": "evt-4e6e827f0206c91125026d75", "src_port": 53, "tcp_stream": null, "udp_stream": 30, "frame_number": 599, "timestamp_epoch": "1582246435.855180000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-fa69db4e195b4a5ff81d6df0", "src_port": 61536, "tcp_stream": null, "udp_stream": 36, "frame_number": 676, "timestamp_epoch": "1582246442.929497000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.114.132.22", "dns.cname": "self.events.data.onecollector.akadns.net,global.aria.events.data.trafficmanager.net,skypedataprdcoleus02.cloudapp.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 61536, "event_id": "evt-cd993f3fd772c3b359e29c45", "src_port": 53, "tcp_stream": null, "udp_stream": 36, "frame_number": 677, "timestamp_epoch": "1582246443.041084000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-7d7a4405873674b2cf7e8522", "src_port": 54516, "tcp_stream": null, "udp_stream": 37, "frame_number": 709, "timestamp_epoch": "1582246446.554333000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54516, "event_id": "evt-780c9f14ad9311b0818bab23", "src_port": 53, "tcp_stream": null, "udp_stream": 37, "frame_number": 710, "timestamp_epoch": "1582246446.554749000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-ab6bb98e17d4e6502b8ee78d", "src_port": 60335, "tcp_stream": null, "udp_stream": 38, "frame_number": 711, "timestamp_epoch": "1582246446.555212000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 60335, "event_id": "evt-39b34e0649dc464cda6a11a6", "src_port": 53, "tcp_stream": null, "udp_stream": 38, "frame_number": 712, "timestamp_epoch": "1582246446.555436000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "ONE-HOT-MESS.NET", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-92a099b618fb920f36518dd5", "src_port": 59333, "tcp_stream": null, "udp_stream": 40, "frame_number": 773, "timestamp_epoch": "1582246452.179610000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "ONE-HOT-MESS.NET", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 59333, "event_id": "evt-feb90b3dac1f26cc32bf33a7", "src_port": 53, "tcp_stream": null, "udp_stream": 40, "frame_number": 774, "timestamp_epoch": "1582246452.179824000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-c58722c5b105cca180acc580", "src_port": 64886, "tcp_stream": null, "udp_stream": 41, "frame_number": 921, "timestamp_epoch": "1582246456.491647000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-b3223b5ad61473a256dbe2c0", "src_port": 50065, "tcp_stream": null, "udp_stream": 42, "frame_number": 922, "timestamp_epoch": "1582246456.548808000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "ow1.res.office365.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-a7621f840a3c2c0c97fee811", "src_port": 54926, "tcp_stream": null, "udp_stream": 43, "frame_number": 923, "timestamp_epoch": "1582246456.602562000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 64886, "event_id": "evt-1582d7d2fe3461203555edcd", "src_port": 53, "tcp_stream": null, "udp_stream": 41, "frame_number": 924, "timestamp_epoch": "1582246456.608292000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "c-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-9972d9472ef6e7cc0e51f05a", "src_port": 58257, "tcp_stream": null, "udp_stream": 44, "frame_number": 926, "timestamp_epoch": "1582246456.627661000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-4fdb991933e6f7209a827154", "src_port": 50065, "tcp_stream": null, "udp_stream": 42, "frame_number": 928, "timestamp_epoch": "1582246457.550518000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "ow1.res.office365.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-18d2af4cca93de91269a8167", "src_port": 54926, "tcp_stream": null, "udp_stream": 43, "frame_number": 929, "timestamp_epoch": "1582246457.597218000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "c-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-74699ae73d663a0f57f4070d", "src_port": 58257, "tcp_stream": null, "udp_stream": 44, "frame_number": 931, "timestamp_epoch": "1582246457.612994000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "23.54.20.139", "dns.cname": "ow1.res.office365.com.edgekey.net,e1875.g.akamaiedge.net", "dns.qry.name": "ow1.res.office365.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54926, "event_id": "evt-3be6dacc0ced0ab4bb4c7fe3", "src_port": 53, "tcp_stream": null, "udp_stream": 43, "frame_number": 936, "timestamp_epoch": "1582246457.808708000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "13.107.4.254", "dns.cname": "c-ring.c-9999.c-msedge.net,c-9999.c-msedge.net", "dns.qry.name": "c-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 58257, "event_id": "evt-65d0bdd6d8950a6acb19e6dd", "src_port": 53, "tcp_stream": null, "udp_stream": 44, "frame_number": 937, "timestamp_epoch": "1582246457.808767000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-e568c11976da5df61ae1a9bd", "src_port": 50065, "tcp_stream": null, "udp_stream": 42, "frame_number": 1020, "timestamp_epoch": "1582246458.550528000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-e9d41eabacce5d611a6dd34b", "src_port": 50065, "tcp_stream": null, "udp_stream": 42, "frame_number": 1034, "timestamp_epoch": "1582246460.567597000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "13.107.3.254", "dns.cname": "s-ring.s-9999.s-msedge.net,s-9999.s-msedge.net", "dns.qry.name": "s-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 50065, "event_id": "evt-83d3ec4e8f1a25bfb786aeae", "src_port": 53, "tcp_stream": null, "udp_stream": 42, "frame_number": 1035, "timestamp_epoch": "1582246460.902826000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-81ba0951a302bd92d2e9ffa9", "src_port": 52250, "tcp_stream": null, "udp_stream": 45, "frame_number": 1179, "timestamp_epoch": "1582246464.057685000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "40.126.5.35,20.190.133.75,20.190.133.66,40.126.5.99,40.126.5.37,40.126.5.98,20.190.133.76,40.126.5.100", "dns.cname": "prda.aadg.msidentity.com,www.tm.a.prd.aadg.akadns.net", "dns.qry.name": "login.microsoftonline.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 52250, "event_id": "evt-6f8ff030886ec754e10e60ae", "src_port": 53, "tcp_stream": null, "udp_stream": 45, "frame_number": 1180, "timestamp_epoch": "1582246464.271335000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-9258391d67702e2ea794efa1", "src_port": 61613, "tcp_stream": null, "udp_stream": 46, "frame_number": 1182, "timestamp_epoch": "1582246464.533063000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_gc._tcp.Default-First-Site-Name._sites.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 61613, "event_id": "evt-4f3778d30f967d873bb0d74c", "src_port": 53, "tcp_stream": null, "udp_stream": 46, "frame_number": 1183, "timestamp_epoch": "1582246464.533342000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-35f0895b8101780db0095e71", "src_port": 51673, "tcp_stream": null, "udp_stream": 48, "frame_number": 1233, "timestamp_epoch": "1582246473.838979000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.114.128.9", "dns.cname": "self.events.data.onecollector.akadns.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 51673, "event_id": "evt-8223c8ee8b062a95ddc87109", "src_port": 53, "tcp_stream": null, "udp_stream": 48, "frame_number": 1234, "timestamp_epoch": "1582246474.059399000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "blueflag.xyz", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-a03959b44831177b45c0024a", "src_port": 62187, "tcp_stream": null, "udp_stream": 49, "frame_number": 1331, "timestamp_epoch": "1582246506.138612000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "49.51.172.56", "dns.qry.name": "blueflag.xyz", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62187, "event_id": "evt-799cc2fce78e71fcf1871701", "src_port": 53, "tcp_stream": null, "udp_stream": 49, "frame_number": 1332, "timestamp_epoch": "1582246506.447128000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-5711f4e6963280211bd1f4dd", "src_port": 54860, "tcp_stream": null, "udp_stream": 50, "frame_number": 1334, "timestamp_epoch": "1582246506.555990000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54860, "event_id": "evt-1ad3e6bf5c89ceba565917fd", "src_port": 53, "tcp_stream": null, "udp_stream": 50, "frame_number": 1335, "timestamp_epoch": "1582246506.556316000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-a37c7e1f4843cc402debaa2a", "src_port": 49859, "tcp_stream": null, "udp_stream": 51, "frame_number": 1336, "timestamp_epoch": "1582246506.556761000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 49859, "event_id": "evt-e7225d33497c6ab29077e507", "src_port": 53, "tcp_stream": null, "udp_stream": 51, "frame_number": 1337, "timestamp_epoch": "1582246506.556980000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-b7677f70e671071b760df62a", "src_port": 49668, "tcp_stream": null, "udp_stream": 52, "frame_number": 1570, "timestamp_epoch": "1582246512.594997000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.114.76.34", "dns.cname": "self.events.data.onecollector.akadns.net", "dns.qry.name": "self.events.data.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 49668, "event_id": "evt-fc0c1dc67aae3f2f26291bee", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 1571, "timestamp_epoch": "1582246512.742109000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-d5f601f03dfeadf65deb3491", "src_port": 60530, "tcp_stream": null, "udp_stream": 53, "frame_number": 1573, "timestamp_epoch": "1582246512.935443000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 60530, "event_id": "evt-d85466b9a5c35d96d9e0ba7a", "src_port": 53, "tcp_stream": null, "udp_stream": 53, "frame_number": 1574, "timestamp_epoch": "1582246512.935824000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-fecbb273abc581331225e685", "src_port": 56238, "tcp_stream": null, "udp_stream": 55, "frame_number": 1708, "timestamp_epoch": "1582246560.531193000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "204.79.197.200,13.107.21.200", "dns.cname": "a-0001.a-afdentry.net.trafficmanager.net,dual-a-0001.a-msedge.net", "dns.qry.name": "www.bing.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 56238, "event_id": "evt-f39f3eaba3f7ef3847e10eb1", "src_port": 53, "tcp_stream": null, "udp_stream": 55, "frame_number": 1709, "timestamp_epoch": "1582246560.676996000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-86e9a3a636b7082934cca246", "src_port": 60770, "tcp_stream": null, "udp_stream": 56, "frame_number": 1741, "timestamp_epoch": "1582246584.660763000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.109.124.20", "dns.cname": "prod.nexusrules.live.com.akadns.net", "dns.qry.name": "nexusrules.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 60770, "event_id": "evt-efa1832a9297be777586300c", "src_port": 53, "tcp_stream": null, "udp_stream": 56, "frame_number": 1744, "timestamp_epoch": "1582246584.856481000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-711ca1e3ff22e762dd1738ef", "src_port": 49668, "tcp_stream": null, "udp_stream": 52, "frame_number": 1798, "timestamp_epoch": "1582246733.394702000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.one-hot-mess.com", "dns.qry.type": "33", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 49668, "event_id": "evt-a635eac94bdb7a5e1adc0893", "src_port": 53, "tcp_stream": null, "udp_stream": 52, "frame_number": 1799, "timestamp_epoch": "1582246733.394985000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-c29fe45f3aa3b61b12effc82", "src_port": 61422, "tcp_stream": null, "udp_stream": 58, "frame_number": 1940, "timestamp_epoch": "1582246971.356190000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-4a45773189ad3c01b4339ef7", "src_port": 50624, "tcp_stream": null, "udp_stream": 59, "frame_number": 1941, "timestamp_epoch": "1582246971.395342000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "13.107.246.10", "dns.cname": "sfd-production.azurefd.net,t-0001.t-msedge.net,Edge-Prod-SJCr3.ctrl.t-0001.t-msedge.net,standard.t-0001.t-msedge.net", "dns.qry.name": "pti.store.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 50624, "event_id": "evt-6d26220821e59a76d24e9002", "src_port": 53, "tcp_stream": null, "udp_stream": 59, "frame_number": 1942, "timestamp_epoch": "1582246971.491797000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 61422, "event_id": "evt-4ebacf6f592192c6a512f15b", "src_port": 53, "tcp_stream": null, "udp_stream": 58, "frame_number": 1944, "timestamp_epoch": "1582246971.561272000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-33364e344b5584793870874b", "src_port": 63391, "tcp_stream": null, "udp_stream": 60, "frame_number": 2003, "timestamp_epoch": "1582247031.809220000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.230.222.68", "dns.cname": "wns.notify.windows.com.akadns.net,americas1.notify.windows.com.akadns.net,dm3p.wns.notify.windows.com.akadns.net", "dns.qry.name": "client.wns.windows.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 63391, "event_id": "evt-7e9b69aa091e0e0d7a98061f", "src_port": 53, "tcp_stream": null, "udp_stream": 60, "frame_number": 2008, "timestamp_epoch": "1582247032.420357000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-0a868724b2c40eacf4992a81", "src_port": 56715, "tcp_stream": null, "udp_stream": 61, "frame_number": 2035, "timestamp_epoch": "1582247034.747042000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "40.91.116.226,40.91.120.196", "dns.cname": "fe2cr.update.microsoft.com.akadns.net", "dns.qry.name": "fe2cr.update.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 56715, "event_id": "evt-97ca10c4ad7c6b8c355f16dd", "src_port": 53, "tcp_stream": null, "udp_stream": 61, "frame_number": 2036, "timestamp_epoch": "1582247034.931427000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-9957a5f6b1190b670d8b0017", "src_port": 60326, "tcp_stream": null, "udp_stream": 62, "frame_number": 2121, "timestamp_epoch": "1582247036.930755000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "64.4.54.18", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 60326, "event_id": "evt-e4b69b0bf07f041da1d8d4c1", "src_port": 53, "tcp_stream": null, "udp_stream": 62, "frame_number": 2122, "timestamp_epoch": "1582247037.024283000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-b213e44d3723706a092155e9", "src_port": 58048, "tcp_stream": null, "udp_stream": 63, "frame_number": 2175, "timestamp_epoch": "1582247106.569307000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.one-hot-mess.com", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 58048, "event_id": "evt-cbdd4898fd4c43d7291f3d60", "src_port": 53, "tcp_stream": null, "udp_stream": 63, "frame_number": 2176, "timestamp_epoch": "1582247106.569609000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-8557eb8f7a20081c469914f2", "src_port": 54269, "tcp_stream": null, "udp_stream": 64, "frame_number": 2177, "timestamp_epoch": "1582247106.569997000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.qry.name": "wpad.localdomain", "dns.qry.type": "1", "dns.flags.rcode": "3", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54269, "event_id": "evt-916e6735238ca5bd82e2b623", "src_port": 53, "tcp_stream": null, "udp_stream": 64, "frame_number": 2178, "timestamp_epoch": "1582247106.570166000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "DESKTOP-TZMKHKC.one-hot-mess.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-d1ea1b51f538d0cc4c909d83", "src_port": 58512, "tcp_stream": null, "udp_stream": 65, "frame_number": 2218, "timestamp_epoch": "1582247330.055127000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.8", "dns.qry.name": "DESKTOP-TZMKHKC.one-hot-mess.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 58512, "event_id": "evt-f07f220ac676eca0c9099ebb", "src_port": 53, "tcp_stream": null, "udp_stream": 65, "frame_number": 2220, "timestamp_epoch": "1582247330.055503000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.a": "172.17.8.174", "dns.qry.name": "one-hot-mess.com", "dns.qry.type": "6", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-545de577181dba28bf643a8e", "src_port": 62976, "tcp_stream": null, "udp_stream": 66, "frame_number": 2222, "timestamp_epoch": "1582247330.056588000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "172.17.8.174", "dns.qry.name": "one-hot-mess.com", "dns.qry.type": "6", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62976, "event_id": "evt-6a50ad01f231016ee93828d9", "src_port": 53, "tcp_stream": null, "udp_stream": 66, "frame_number": 2226, "timestamp_epoch": "1582247330.057439000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-8bafe3fcbfbbbe521167b88f", "src_port": 54051, "tcp_stream": null, "udp_stream": 68, "frame_number": 2249, "timestamp_epoch": "1582247333.882191000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "64.4.54.18", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54051, "event_id": "evt-2b3f3c9c729145ccae6675ca", "src_port": 53, "tcp_stream": null, "udp_stream": 68, "frame_number": 2250, "timestamp_epoch": "1582247334.195082000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-951600cb75e278bc15625b30", "src_port": 55694, "tcp_stream": null, "udp_stream": 69, "frame_number": 2318, "timestamp_epoch": "1582247353.836174000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-92d99ac4dd771e5fa31e4ff9", "src_port": 57672, "tcp_stream": null, "udp_stream": 70, "frame_number": 2319, "timestamp_epoch": "1582247354.647613000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.109.2.55", "dns.cname": "prod.mrodevicemgr.live.com.akadns.net", "dns.qry.name": "mrodevicemgr.officeapps.live.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 57672, "event_id": "evt-cc221396635743ac2d0d36d0", "src_port": 53, "tcp_stream": null, "udp_stream": 70, "frame_number": 2320, "timestamp_epoch": "1582247354.748161000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-135509a58a2608dbe8f8f70e", "src_port": 55694, "tcp_stream": null, "udp_stream": 69, "frame_number": 2322, "timestamp_epoch": "1582247354.839056000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "officecdn.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-753a0d56dbf11191bbaf4049", "src_port": 60181, "tcp_stream": null, "udp_stream": 71, "frame_number": 2351, "timestamp_epoch": "1582247355.766165000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-a07da87851a9480318cbe1ee", "src_port": 55694, "tcp_stream": null, "udp_stream": 69, "frame_number": 2352, "timestamp_epoch": "1582247355.849231000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "23.54.20.119", "dns.cname": "office.c2r.akadns.net,2-01-3f20-0003.cdx.cedexis.net,office-prod.edgekey.net,office-prod.edgekey.net.globalredir.akadns.net,e1723.dscd.akamaiedge.net", "dns.qry.name": "officecdn.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 60181, "event_id": "evt-cb251cdbbb026ca47ad91a34", "src_port": 53, "tcp_stream": null, "udp_stream": 71, "frame_number": 2353, "timestamp_epoch": "1582247355.864518000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "13.107.3.128", "dns.cname": "s-0001.s-msedge.net", "dns.qry.name": "config.edge.skype.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 55694, "event_id": "evt-9da6f7e9a948e9ae7c779d8b", "src_port": 53, "tcp_stream": null, "udp_stream": 69, "frame_number": 3149, "timestamp_epoch": "1582247357.668186000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-0aabaa4808a077867cb03712", "src_port": 50399, "tcp_stream": null, "udp_stream": 72, "frame_number": 4436, "timestamp_epoch": "1582247509.660085000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "204.79.197.222", "dns.cname": "1.perf.msedge.net,a-0019.a-msedge.net", "dns.qry.name": "fp.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 50399, "event_id": "evt-08c5e4bdfa552ef66711d3e9", "src_port": 53, "tcp_stream": null, "udp_stream": 72, "frame_number": 4437, "timestamp_epoch": "1582247509.811440000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "fp-vp.azureedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-90af61fb83783540a00bce48", "src_port": 54226, "tcp_stream": null, "udp_stream": 73, "frame_number": 4540, "timestamp_epoch": "1582247512.934284000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "72.21.81.200", "dns.cname": "fp-vp.ec.azureedge.net,cs9.wpc.v0cdn.net", "dns.qry.name": "fp-vp.azureedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54226, "event_id": "evt-219d65ea1aa446c1165cea0d", "src_port": 53, "tcp_stream": null, "udp_stream": 73, "frame_number": 4541, "timestamp_epoch": "1582247513.062427000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-6f4baf4f46fbf293aa422809", "src_port": 61871, "tcp_stream": null, "udp_stream": 74, "frame_number": 4666, "timestamp_epoch": "1582247513.709545000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "204.79.197.254", "dns.cname": "a-ring.a-9999.a-msedge.net,a-9999.a-msedge.net", "dns.qry.name": "a-ring.msedge.net", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 61871, "event_id": "evt-a2f617e5f9538f6070491396", "src_port": 53, "tcp_stream": null, "udp_stream": 74, "frame_number": 4671, "timestamp_epoch": "1582247513.802766000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "tsfe.trafficshaping.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-0c340a8a9cb9cb2741084400", "src_port": 50909, "tcp_stream": null, "udp_stream": 75, "frame_number": 5523, "timestamp_epoch": "1582247640.723717000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "tsfe.trafficshaping.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-d750ca860840776ddf241f0b", "src_port": 50909, "tcp_stream": null, "udp_stream": 75, "frame_number": 5524, "timestamp_epoch": "1582247640.931841000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "tsfe.trafficshaping.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-5d0f192e3ae830a8f92effc1", "src_port": 50909, "tcp_stream": null, "udp_stream": 75, "frame_number": 5525, "timestamp_epoch": "1582247641.962233000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "52.159.17.76", "dns.cname": "tsfe.trafficmanager.net", "dns.qry.name": "tsfe.trafficshaping.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 50909, "event_id": "evt-33d1764053ac7e8f76632ac1", "src_port": 53, "tcp_stream": null, "udp_stream": 75, "frame_number": 5526, "timestamp_epoch": "1582247641.965800000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-935cc9105671c2246dd4037d", "src_port": 57395, "tcp_stream": null, "udp_stream": 76, "frame_number": 5634, "timestamp_epoch": "1582247644.477120000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "40.69.216.73", "dns.cname": "geo-prod.do.dsp.mp.microsoft.com,geo-prod.dodsp.mp.microsoft.com.nsatc.net,array611-prod.do.dsp.mp.microsoft.com", "dns.qry.name": "geo.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 57395, "event_id": "evt-8a5f80de52300028d82661b9", "src_port": 53, "tcp_stream": null, "udp_stream": 76, "frame_number": 5635, "timestamp_epoch": "1582247644.559781000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "kv601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-4c6b2b7a87c0438c170f1d48", "src_port": 53951, "tcp_stream": null, "udp_stream": 77, "frame_number": 5658, "timestamp_epoch": "1582247645.910395000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "104.77.69.193", "dns.cname": "kv601.prod.dodsp.mp.microsoft.com.nsatc.net,kv601.prod.do.dsp.mp.microsoft.com.edgekey.net,e12358.g.akamaiedge.net", "dns.qry.name": "kv601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 53951, "event_id": "evt-9560ab3177dee31c3e11bcd5", "src_port": 53, "tcp_stream": null, "udp_stream": 77, "frame_number": 5659, "timestamp_epoch": "1582247646.003943000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "cp601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-339bc4cbc9fcf8665862d89f", "src_port": 50558, "tcp_stream": null, "udp_stream": 78, "frame_number": 5684, "timestamp_epoch": "1582247646.578807000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "104.77.69.193", "dns.cname": "cp601.prod.dodsp.mp.microsoft.com.nsatc.net,cp601.prod.do.dsp.mp.microsoft.com.edgekey.net,e12358.g.akamaiedge.net", "dns.qry.name": "cp601.prod.do.dsp.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 50558, "event_id": "evt-70e5f9f7d8a4ece653adb891", "src_port": 53, "tcp_stream": null, "udp_stream": 78, "frame_number": 5685, "timestamp_epoch": "1582247646.674447000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-ae958e558204e08cbb299a37", "src_port": 61650, "tcp_stream": null, "udp_stream": 79, "frame_number": 5687, "timestamp_epoch": "1582247646.687310000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "64.4.54.18", "dns.cname": "fe3.delivery.mp.microsoft.com,fe3.delivery.dsp.mp.microsoft.com.nsatc.net", "dns.qry.name": "fe3cr.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 61650, "event_id": "evt-32b1b0a5d66a38b4bb675120", "src_port": 53, "tcp_stream": null, "udp_stream": 79, "frame_number": 5692, "timestamp_epoch": "1582247646.788647000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-20e80c06fb95ddee8790b66c", "src_port": 62300, "tcp_stream": null, "udp_stream": 80, "frame_number": 5719, "timestamp_epoch": "1582247647.209505000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "13.107.4.50", "dns.cname": "2-01-3cf7-000c.cdx.cedexis.net,nontlu.graystore.au-msedge.net,graystore.c-0001.c-msedge.net,c-0001.c-msedge.net", "dns.qry.name": "dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 62300, "event_id": "evt-721504a69548570a864efe00", "src_port": 53, "tcp_stream": null, "udp_stream": 80, "frame_number": 5742, "timestamp_epoch": "1582247647.303609000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "2.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-7e60766752531b7cdb4a05b2", "src_port": 52862, "tcp_stream": null, "udp_stream": 81, "frame_number": 5770, "timestamp_epoch": "1582247647.504799000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "23.1.236.125,23.1.236.85,23.1.236.114,23.1.236.92,23.1.236.100,23.1.236.98,23.1.236.75,23.1.236.74,23.1.236.107", "dns.cname": "2.tlu.dl.delivery.mp.microsoft.com.edgesuite.net,a122.dscg3.akamai.net", "dns.qry.name": "2.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 52862, "event_id": "evt-c5afecab17119201e0807b5b", "src_port": 53, "tcp_stream": null, "udp_stream": 81, "frame_number": 5776, "timestamp_epoch": "1582247647.592563000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-d8aaf550dcc56c826fa6e1f4", "src_port": 54930, "tcp_stream": null, "udp_stream": 82, "frame_number": 5779, "timestamp_epoch": "1582247647.604485000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "205.185.216.42,205.185.216.10", "dns.cname": "2-01-3cf7-000d.cdx.cedexis.net,cds.f7y3z2w8.hwcdn.net", "dns.qry.name": "tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 54930, "event_id": "evt-41adac763149ad11373081dc", "src_port": 53, "tcp_stream": null, "udp_stream": 82, "frame_number": 5789, "timestamp_epoch": "1582247647.697828000" }, { "kind": "dns", "dst_ip": "172.17.8.8", "fields": { "dns.qry.name": "7.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.response": "False" }, "src_ip": "172.17.8.174", "dst_port": 53, "event_id": "evt-170a1340da8fa0a7ef69e379", "src_port": 51627, "tcp_stream": null, "udp_stream": 83, "frame_number": 8924, "timestamp_epoch": "1582247651.264426000" }, { "kind": "dns", "dst_ip": "172.17.8.174", "fields": { "dns.a": "13.107.4.50", "dns.cname": "tlu.graystore.au-msedge.net,tlu-graystore.c-0001.c-msedge.net,c-0001.c-msedge.net", "dns.qry.name": "7.tlu.dl.delivery.mp.microsoft.com", "dns.qry.type": "1", "dns.flags.rcode": "0", "dns.flags.response": "True" }, "src_ip": "172.17.8.8", "dst_port": 51627, "event_id": "evt-abfc48ea75aa44e7ce130007", "src_port": 53, "tcp_stream": null, "udp_stream": 83, "frame_number": 8935, "timestamp_epoch": "1582247651.373628000" } ], "dhcp": [ { "kind": "dhcp", "dst_ip": "255.255.255.255", "fields": { "eth.src": "00:11:75:8c:fd:47", "dhcp.ip.your": "0.0.0.0", "dhcp.hw.mac_addr": "00:11:75:8c:fd:47,00:11:75:8c:fd:47", "dhcp.option.dhcp": "3", "dhcp.option.hostname": "DESKTOP-TZMKHKC", "dhcp.option.requested_ip_address": "172.17.8.174" }, "src_ip": "0.0.0.0", "dst_port": null, "event_id": "evt-5fa038c7437df1d96ac17ca4", "src_port": null, "tcp_stream": null, "udp_stream": 0, "frame_number": 1, "timestamp_epoch": "1582246430.628828000" }, { "kind": "dhcp", "dst_ip": "172.17.8.174", "fields": { "eth.src": "00:50:56:f3:8d:ca", "dhcp.ip.your": "172.17.8.174", "dhcp.hw.mac_addr": "00:11:75:8c:fd:47", "dhcp.option.dhcp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9264706e3b5eb8d96cd45305", "src_port": null, "tcp_stream": null, "udp_stream": 1, "frame_number": 2, "timestamp_epoch": "1582246430.629296000" } ], "smtp": [], "identity": [ { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:75:8c:fd:47", "dns.qry.name": "DESKTOP-TZMKHKC.local" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5cb4a2a34070db8784c52c20", "src_port": null, "tcp_stream": null, "udp_stream": 2, "frame_number": 5, "timestamp_epoch": "1582246430.827640000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-218a933d67d03373b474d4b4", "src_port": null, "tcp_stream": null, "udp_stream": 2, "frame_number": 6, "timestamp_epoch": "1582246430.827974000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:75:8c:fd:47", "dns.qry.name": "DESKTOP-TZMKHKC" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c8ee0b010de7eef28a6cc93c", "src_port": null, "tcp_stream": null, "udp_stream": 3, "frame_number": 7, "timestamp_epoch": "1582246430.832491000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b662eddc1f92726d751999cf", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 32, "timestamp_epoch": "1582246432.114052000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d8375ec4bba0246ebfadd8a0", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 33, "timestamp_epoch": "1582246432.114189000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ee6ebf5a171c0bb250a7f83c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 57, "timestamp_epoch": "1582246432.365283000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d570493896d10cad8dde4fd1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 58, "timestamp_epoch": "1582246432.365528000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3a569ee90b3bd34c6780df4a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 61, "timestamp_epoch": "1582246432.365924000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-tzmkhkc$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-695f6ba8c48654e545309346", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 87, "timestamp_epoch": "1582246432.385405000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f142d4c2db32ce1c75a291cd", "src_port": null, "tcp_stream": 5, "udp_stream": null, "frame_number": 88, "timestamp_epoch": "1582246432.385871000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-tzmkhkc$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-816a41917520f8efe80c46ee", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 95, "timestamp_epoch": "1582246432.387731000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4904b07921470d79da8979f7", "src_port": null, "tcp_stream": 6, "udp_stream": null, "frame_number": 96, "timestamp_epoch": "1582246432.388015000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-tzmkhkc$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5b338af40a7eb321cbdb3aad", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 108, "timestamp_epoch": "1582246432.396796000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-tzmkhkc$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-aff355b7bedab8af5385aa81", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 111, "timestamp_epoch": "1582246432.397151000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-tzmkhkc$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e27e82012a3f157b6eaf3e4b", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 112, "timestamp_epoch": "1582246432.397245000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-43b389190046f4fc4118b95e", "src_port": null, "tcp_stream": 8, "udp_stream": null, "frame_number": 113, "timestamp_epoch": "1582246432.397710000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c3f5712ee55bff1412bf0c4d", "src_port": null, "tcp_stream": 7, "udp_stream": null, "frame_number": 115, "timestamp_epoch": "1582246432.398050000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a7f6bd86e2a4f54512d90ecb", "src_port": null, "tcp_stream": 9, "udp_stream": null, "frame_number": 120, "timestamp_epoch": "1582246432.398372000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "desktop-tzmkhkc$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-fcc736982df6666cbfb30b75", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 133, "timestamp_epoch": "1582246432.408105000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-54ee81de1a889e3a84378c78", "src_port": null, "tcp_stream": 10, "udp_stream": null, "frame_number": 135, "timestamp_epoch": "1582246432.408783000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ffe5ad08352e42aff496e78b", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 146, "timestamp_epoch": "1582246432.411998000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-fb57fac475a314fe79e50bcd", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 150, "timestamp_epoch": "1582246432.412210000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b963a4ddb695d9bc7e67f5dd", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 156, "timestamp_epoch": "1582246432.412705000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c14b030307713afcb9ee6899", "src_port": null, "tcp_stream": 11, "udp_stream": null, "frame_number": 158, "timestamp_epoch": "1582246432.412911000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-20eb67a95b5d2a14b86c3141", "src_port": null, "tcp_stream": 12, "udp_stream": null, "frame_number": 163, "timestamp_epoch": "1582246432.413267000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8895d301f8db1e6754c32ac2", "src_port": null, "tcp_stream": 13, "udp_stream": null, "frame_number": 171, "timestamp_epoch": "1582246432.413736000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-00e8e6ed0606651560176afd", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 177, "timestamp_epoch": "1582246432.414003000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-84eb22e1e724c0714c700cbd", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1582246432.414326000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-50ca19611ec7691bc4b607e1", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 186, "timestamp_epoch": "1582246432.414729000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-683c10a0fb69bd0400d1e7f9", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 188, "timestamp_epoch": "1582246432.414895000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-604747096418fce706aacd98", "src_port": null, "tcp_stream": 14, "udp_stream": null, "frame_number": 190, "timestamp_epoch": "1582246432.415156000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-e326035a666d6ec7c3db29ef", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1582246432.415230000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-906fb9ec4b48d6801ea3a288", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 198, "timestamp_epoch": "1582246432.416233000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d992ce22393dedb276dfe427", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 207, "timestamp_epoch": "1582246432.418530000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6fc34ada0289e491cb93ba49", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 209, "timestamp_epoch": "1582246432.419386000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-eeaae2be13ac1cb6dc828c39", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 210, "timestamp_epoch": "1582246432.419623000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8fbedfe99cfafdf97eb7fc03", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 212, "timestamp_epoch": "1582246432.419911000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-67793bd2dcd749711d62217e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 214, "timestamp_epoch": "1582246432.420164000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-80d9167a46bb5864dfe9e315", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 217, "timestamp_epoch": "1582246432.431311000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d84b64bab431f7a321104f4c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 218, "timestamp_epoch": "1582246432.431733000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-402a1e497b33af5df682082e", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 226, "timestamp_epoch": "1582246432.461731000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7e2470396c6671ba7bcb171d", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 228, "timestamp_epoch": "1582246432.462536000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-73e8e29010aec8ab9e3f740a", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 229, "timestamp_epoch": "1582246432.462813000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-dc12612f67470ce60c5eb249", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 240, "timestamp_epoch": "1582246432.465403000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c52a6a55202e037063236b31", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 242, "timestamp_epoch": "1582246432.465945000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4fec351c82c3c3f672738bd8", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 243, "timestamp_epoch": "1582246432.466158000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-20b0c1e7eb3b65ece77954bf", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 252, "timestamp_epoch": "1582246432.483548000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-14d22d9e4e4676b838cc01bd", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 253, "timestamp_epoch": "1582246432.484000000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a175fc5220d54ba2385e5c31", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 284, "timestamp_epoch": "1582246432.654342000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a75f6c1bac60b3cb5a3b0e33", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 287, "timestamp_epoch": "1582246432.654975000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-034718e5b96001e30dffef26", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 288, "timestamp_epoch": "1582246432.655296000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b10d43b7dcb868455664a651", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 314, "timestamp_epoch": "1582246432.776672000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-69bbd8627cfb8af442136d83", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1582246432.989576000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a01b4d22f7d54c79742979bd", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 336, "timestamp_epoch": "1582246432.990383000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-726693b2e1f4dfabf72a520b", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 341, "timestamp_epoch": "1582246433.006433000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8bed7fd2e51b6b294d9cef86", "src_port": null, "tcp_stream": 21, "udp_stream": null, "frame_number": 344, "timestamp_epoch": "1582246433.007594000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4899d0d0a6674ae0bc7508db", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1582246433.013313000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1f583a974ef1e72814065e73", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1582246433.013978000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-651bb52d516325f85f19d611", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 370, "timestamp_epoch": "1582246433.097570000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-15cc86919ac6be93ef18b134", "src_port": null, "tcp_stream": 23, "udp_stream": null, "frame_number": 373, "timestamp_epoch": "1582246433.098368000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-efc018cf0920d0cc171565f7", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 382, "timestamp_epoch": "1582246433.099530000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4614217b39bd621530929d52", "src_port": null, "tcp_stream": 24, "udp_stream": null, "frame_number": 385, "timestamp_epoch": "1582246433.099805000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-842cff273e260bd491b1bf53", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 392, "timestamp_epoch": "1582246433.100237000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-078edae78a602bdb6513da02", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 394, "timestamp_epoch": "1582246433.101762000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c4145927b00057b1e7a745e7", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 395, "timestamp_epoch": "1582246433.102202000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5550bd5be6e60fdf4c52f490", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 396, "timestamp_epoch": "1582246433.102434000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3ea8f50373fd71daf43d77b5", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 397, "timestamp_epoch": "1582246433.121395000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3aa9e4064176322cac641267", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 398, "timestamp_epoch": "1582246433.121803000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-543a333b9dc6600c5b4b9245", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 399, "timestamp_epoch": "1582246433.123314000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ba036c32affdd0783789b8fc", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 400, "timestamp_epoch": "1582246433.123433000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c494011f32c71ac9c92439c0", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 401, "timestamp_epoch": "1582246433.129713000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f6b4f367bec40c0c1d9be90d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 402, "timestamp_epoch": "1582246433.129962000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-45415f8f096be6bf6c99215e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 403, "timestamp_epoch": "1582246433.134645000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6c9956a71f5fc1de414f168a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 404, "timestamp_epoch": "1582246433.134981000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3945fcea9b1f07d4b1555c2b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 405, "timestamp_epoch": "1582246433.135304000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3e345e984db23dcd32a2600e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 406, "timestamp_epoch": "1582246433.135416000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ebe59f4081c1a0f7924507b0", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 407, "timestamp_epoch": "1582246433.135629000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b88373daae0978a32a8b4b74", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 408, "timestamp_epoch": "1582246433.135778000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5d01da08bd9bfb517be51640", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 409, "timestamp_epoch": "1582246433.136929000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-513fa3d3f7e4e662838d0bb3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 410, "timestamp_epoch": "1582246433.137189000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3e75fb22f533520e026d0c8d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 411, "timestamp_epoch": "1582246433.137435000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d58c0e9990ac276aa67ef1f8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 412, "timestamp_epoch": "1582246433.137536000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-fe3b0ed8531d9822d1338129", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 413, "timestamp_epoch": "1582246433.138254000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a33c800d0164fd80532d8cda", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 414, "timestamp_epoch": "1582246433.138465000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b04b0d8c9f66ef5f6354732e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 415, "timestamp_epoch": "1582246433.139240000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-65e4eaac6c04600b2ff366b3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 416, "timestamp_epoch": "1582246433.139442000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0eb453a9bc3ed16dab7ca37d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 417, "timestamp_epoch": "1582246433.139667000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-acce692b0a54d5bab93302e8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 418, "timestamp_epoch": "1582246433.139772000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6f40c7cff3687bd90a79186f", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 419, "timestamp_epoch": "1582246433.139901000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d3cd8a125d11d1b0ae456516", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 420, "timestamp_epoch": "1582246433.140092000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9403b038e59219ca8464a7e9", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 421, "timestamp_epoch": "1582246433.140663000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2f6c9e6e578066e00f96989d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 422, "timestamp_epoch": "1582246433.140875000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-98b8008d1ef6a3d6c64a9d2c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 423, "timestamp_epoch": "1582246433.142306000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7efce65175ec4593d9828847", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 424, "timestamp_epoch": "1582246433.142433000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d3987dba7a51482b6129c5d4", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 425, "timestamp_epoch": "1582246433.142589000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0fe86d89a45c5b94bdd614bb", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 426, "timestamp_epoch": "1582246433.142740000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-cc94a8a3e7161abcef01fd04", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 427, "timestamp_epoch": "1582246433.143100000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ae84b90e186937b817e4de23", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 428, "timestamp_epoch": "1582246433.143317000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-57659e8f7d03c0f78a9161c8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 429, "timestamp_epoch": "1582246433.143871000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2251c0a4e5e0a8403270ec68", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 430, "timestamp_epoch": "1582246433.143980000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9c1687e1a4af7db806799032", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 431, "timestamp_epoch": "1582246433.144156000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-861cd2ed5d20aad568c583b8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 432, "timestamp_epoch": "1582246433.144255000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e2795240dbd578304c60b9d8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 433, "timestamp_epoch": "1582246433.144685000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3eaf1a42cd2238df944248bf", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 434, "timestamp_epoch": "1582246433.144826000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1d2e318839a6132828715f7f", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 435, "timestamp_epoch": "1582246433.145038000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b9e3522e492c2f638abc463b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 436, "timestamp_epoch": "1582246433.145144000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-68130bc859251ca2fe86d67d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 437, "timestamp_epoch": "1582246433.145432000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d216198b7cd699d3f94533b9", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 438, "timestamp_epoch": "1582246433.145523000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7a05d58b0bf6e13d71aff47e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 439, "timestamp_epoch": "1582246433.145718000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1a7d1424b16e190ed1eb6cc2", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 440, "timestamp_epoch": "1582246433.145843000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d683e0108c562a9436d42217", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 441, "timestamp_epoch": "1582246433.146041000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c5ab2d07058c4f6ecdfb7242", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 442, "timestamp_epoch": "1582246433.146147000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-af181efb9363537e99b0ed76", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 443, "timestamp_epoch": "1582246433.146273000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6522f98c1928904ec8fc1f9e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 444, "timestamp_epoch": "1582246433.146364000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b6139bb2d471bb32be516565", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 445, "timestamp_epoch": "1582246433.147015000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ad973a0015b9e7792fd7c7ed", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 446, "timestamp_epoch": "1582246433.147149000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e80999d306104ea31ae4e9a1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 447, "timestamp_epoch": "1582246433.147804000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f0dd17b2a2865183ef99e9a9", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 448, "timestamp_epoch": "1582246433.147926000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-56780d055b1ad8f9cfe0360c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 449, "timestamp_epoch": "1582246433.148172000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-92a2f055d908c259d62cb183", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 450, "timestamp_epoch": "1582246433.148292000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-755f2c806eb62fa012dd430f", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 451, "timestamp_epoch": "1582246433.148639000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-fc4cf14769fd62c0faf629c9", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 452, "timestamp_epoch": "1582246433.148754000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-34ae22f969ae4b4c08295aa3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 453, "timestamp_epoch": "1582246433.148972000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f54f0516847fc29a48271b41", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 454, "timestamp_epoch": "1582246433.149225000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1e202dfffe2e80c1b1e1b87e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 455, "timestamp_epoch": "1582246433.149389000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6f276217cb14909c619a3fce", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 456, "timestamp_epoch": "1582246433.149476000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6c5f82327bb5e75dc4b0a67a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 457, "timestamp_epoch": "1582246433.149714000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6aaf913764df022a203de1b7", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 458, "timestamp_epoch": "1582246433.149799000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ee331688996d8bcf54917500", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 459, "timestamp_epoch": "1582246433.149911000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-13202552290243ce8cc6bf60", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 460, "timestamp_epoch": "1582246433.150043000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1f2ed820d1c1aee36a27b75b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 461, "timestamp_epoch": "1582246433.150258000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5491063e5c7e11a973a84afd", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 462, "timestamp_epoch": "1582246433.150346000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b4441c0c6051a7a889cce261", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 463, "timestamp_epoch": "1582246433.150476000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-59c462ebe05ef6b7f9b1e617", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 464, "timestamp_epoch": "1582246433.150554000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-65df4238aa84219d2a22eb4f", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 465, "timestamp_epoch": "1582246433.150778000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d3fa9ed1b0712f138794c44e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 466, "timestamp_epoch": "1582246433.150865000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f763f2b5f7ad6d92fad9cafe", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 467, "timestamp_epoch": "1582246433.150957000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-20edafc304e84eeef4a6317e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 468, "timestamp_epoch": "1582246433.151033000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-43dcc4fc870be6554bfaee7c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 469, "timestamp_epoch": "1582246433.151284000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-43de57fa6c6c6a317e575217", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 470, "timestamp_epoch": "1582246433.151359000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3b6b5ad15796073bc3252ada", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 471, "timestamp_epoch": "1582246433.152086000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b15fc4b5ef56216d0e860bfe", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 472, "timestamp_epoch": "1582246433.152162000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d7b3d24df4f1f64b17a08a77", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 473, "timestamp_epoch": "1582246433.152286000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4799e04ee58ed080fd1ab2e7", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 475, "timestamp_epoch": "1582246433.152406000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-20f3a2c22e590bda03bcada1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 477, "timestamp_epoch": "1582246433.152661000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-846a653530d9b1a14275f03e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 478, "timestamp_epoch": "1582246433.152772000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c17f24e411ff2508a4dc25d4", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 479, "timestamp_epoch": "1582246433.153093000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a28dfaf7626a2630d8905659", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 480, "timestamp_epoch": "1582246433.153238000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-bbb9e6e4f9391e691d889562", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 481, "timestamp_epoch": "1582246433.153436000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-452f3b657fff3a330cb4b7e8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 482, "timestamp_epoch": "1582246433.153517000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-03b618d8ad5223946f9cca49", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 483, "timestamp_epoch": "1582246433.154267000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a57369c9e6fb70f89aa648c3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 484, "timestamp_epoch": "1582246433.154349000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b90dbf1a0898c192f1fbffa6", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 485, "timestamp_epoch": "1582246433.154869000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c6529982effafdce6160a05b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 486, "timestamp_epoch": "1582246433.154960000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4b85b85f8d52baebc20e6789", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 487, "timestamp_epoch": "1582246433.155255000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7888c48402c15bb35da46c42", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 488, "timestamp_epoch": "1582246433.155415000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a1cdd1bb1ee33bde6ced92d8", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 489, "timestamp_epoch": "1582246433.156350000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5ab17fd37a758c173007d8e3", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 490, "timestamp_epoch": "1582246433.156432000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f18ded19d474d3ca528ea884", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 491, "timestamp_epoch": "1582246433.156582000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d46583a248e00bf5f3757016", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 492, "timestamp_epoch": "1582246433.156660000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a8609c7ad09db68122ca7578", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 493, "timestamp_epoch": "1582246433.156760000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-404e7f8f47f5b0ff703e879b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 494, "timestamp_epoch": "1582246433.156844000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ede7dc883caf9674af3c3c58", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 495, "timestamp_epoch": "1582246433.157047000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b105eddeca02a3abda2ae467", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 496, "timestamp_epoch": "1582246433.157124000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a81a7f11983e453c73fb40fb", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 497, "timestamp_epoch": "1582246433.157264000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-302beec08790dd7812d2716d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 498, "timestamp_epoch": "1582246433.157339000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ee8438bc03e6dae4671fe07a", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 499, "timestamp_epoch": "1582246433.157715000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-05d86e874d2a51b1dfeda3e9", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 500, "timestamp_epoch": "1582246433.157789000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c3d9b8ef2b7e8eef827c683d", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 501, "timestamp_epoch": "1582246433.166688000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-199eb70089d47e8a4b382393", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 502, "timestamp_epoch": "1582246433.166897000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3a1c754fc8fad4da6d1e8b4b", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 504, "timestamp_epoch": "1582246433.211879000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-54c2e17b07ad64ac7485b0a1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 505, "timestamp_epoch": "1582246433.212134000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c3c75b0014b1fc5632ce3057", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 513, "timestamp_epoch": "1582246433.612482000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c21984b73bb9a411a9b60a9b", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 514, "timestamp_epoch": "1582246433.612559000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c2b99f4ba032b6da8526a0f5", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 515, "timestamp_epoch": "1582246434.271047000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f2f8e506c158b4231c623850", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 531, "timestamp_epoch": "1582246434.441391000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d9e2a18f3b6a932edd979d2c", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 533, "timestamp_epoch": "1582246434.442203000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3029558538dbcda7c0f9633e", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 534, "timestamp_epoch": "1582246434.442591000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-abf2254bd66da1cdfedd6983", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 558, "timestamp_epoch": "1582246434.451789000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-11238329cc2a0e48e8d744b9", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 560, "timestamp_epoch": "1582246434.452516000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-937ef711377a443e5de7e08c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 571, "timestamp_epoch": "1582246434.456877000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4b1b6d248ad3da1b3b9096c1", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1582246434.457650000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3e20e29c58e310bb00b0d87b", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 593, "timestamp_epoch": "1582246435.130059000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a4c049ed6d4f7007abc0a828", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 594, "timestamp_epoch": "1582246435.130251000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e2f44abf76793f6ccdad6527", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 595, "timestamp_epoch": "1582246435.849019000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-deb04bcd019fca8e700e6800", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 600, "timestamp_epoch": "1582246436.770248000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f13b2f2b5a3813834b7a4f68", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 601, "timestamp_epoch": "1582246436.770479000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-123ceb8d219946b4b718e290", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 602, "timestamp_epoch": "1582246437.457960000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6602bb9c9751ad7ab2bb0dc9", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 603, "timestamp_epoch": "1582246437.567971000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-37750b1d17e19719873a00a1", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 604, "timestamp_epoch": "1582246437.568171000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-01e6d185dfaa479e22c6d3ce", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 605, "timestamp_epoch": "1582246438.208416000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-436ff7bc735af97c6ba6cb39", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 606, "timestamp_epoch": "1582246438.364853000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f51417fa0579001513e8bf71", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 607, "timestamp_epoch": "1582246438.365100000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-65ad804f7c60cf78c5b78b49", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 610, "timestamp_epoch": "1582246439.020962000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-dfacb15f9ccc62e8ee9f1a6f", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 611, "timestamp_epoch": "1582246439.145311000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "True" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1fb2232743364efc6207d6e1", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 612, "timestamp_epoch": "1582246439.145404000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "5", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7045533996dcc62b41c2439c", "src_port": null, "tcp_stream": null, "udp_stream": 31, "frame_number": 613, "timestamp_epoch": "1582246439.802180000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "browser.server": "DESKTOP-TZMKHKC" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-15027f49b99638de14084781", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 616, "timestamp_epoch": "1582246440.592958000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a8380984c8938e5e1a12b116", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1582246441.618255000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b37f94032ae342e551721f68", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 629, "timestamp_epoch": "1582246441.619162000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4a883107d2478f5c1cd7ef74", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 643, "timestamp_epoch": "1582246441.627639000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-71f4df9e6f2f1242620bc305", "src_port": null, "tcp_stream": 31, "udp_stream": null, "frame_number": 644, "timestamp_epoch": "1582246441.628044000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-02ebcb1245f72225ce47a7b3", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 651, "timestamp_epoch": "1582246441.628800000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c5dd7ed719b44f0105aff385", "src_port": null, "tcp_stream": 32, "udp_stream": null, "frame_number": 653, "timestamp_epoch": "1582246441.629361000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1ba55749d655a976b0740c37", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 662, "timestamp_epoch": "1582246441.630204000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "DESKTOP-TZMKHKC$" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a720c28f7b533a70c0e6079c", "src_port": null, "tcp_stream": 33, "udp_stream": null, "frame_number": 665, "timestamp_epoch": "1582246441.630896000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f846fb7899ef837309560eb2", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 683, "timestamp_epoch": "1582246443.191335000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d6902d282c327c2e31be8355", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 684, "timestamp_epoch": "1582246443.191586000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1e19ab7ab08a85d3aa4512b1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 685, "timestamp_epoch": "1582246443.191877000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-73b1db13a01129e0773174fa", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 686, "timestamp_epoch": "1582246443.192089000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-11e2212898b86ef482a83837", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 718, "timestamp_epoch": "1582246452.084558000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0000708fc662c602534844f2", "src_port": null, "tcp_stream": 35, "udp_stream": null, "frame_number": 719, "timestamp_epoch": "1582246452.085166000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "10", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-be87b6678a9bf8a3125c393f", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 726, "timestamp_epoch": "1582246452.096627000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "11", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-42510277e17b40727f8b7640", "src_port": null, "tcp_stream": 36, "udp_stream": null, "frame_number": 728, "timestamp_epoch": "1582246452.097349000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4c40738de3e8e2192c2a63e3", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 737, "timestamp_epoch": "1582246452.098261000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b145b36e45a1dedce407506f", "src_port": null, "tcp_stream": 37, "udp_stream": null, "frame_number": 740, "timestamp_epoch": "1582246452.099035000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-21af7d8e00221d22fe06bd07", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 751, "timestamp_epoch": "1582246452.170451000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1da8d98bec960fb41cf17c4b", "src_port": null, "tcp_stream": 38, "udp_stream": null, "frame_number": 754, "timestamp_epoch": "1582246452.171263000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-40085c3d6428c091087503df", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 760, "timestamp_epoch": "1582246452.172819000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4ba72acd29f572df80672b98", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 762, "timestamp_epoch": "1582246452.173318000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a29587ba22ba15f03dc9edcf", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 763, "timestamp_epoch": "1582246452.173627000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-59baa5b684853af493efb8c5", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 779, "timestamp_epoch": "1582246452.187456000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a3839a6e0000f6675243a298", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 780, "timestamp_epoch": "1582246452.188106000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d2097e75d5f5c389f223857e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 781, "timestamp_epoch": "1582246452.188509000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7eacbd8e21b73f9231c7cead", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 787, "timestamp_epoch": "1582246452.192913000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-932bac921ba4607a18543945", "src_port": null, "tcp_stream": 40, "udp_stream": null, "frame_number": 789, "timestamp_epoch": "1582246452.193479000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1ee3910e758e275dc83a190c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 794, "timestamp_epoch": "1582246452.212377000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-caa28e1e01ad96059b5ddc6e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 795, "timestamp_epoch": "1582246452.212932000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "ntlmssp.auth.domain": "ONE-HOT-MESS", "ntlmssp.auth.hostname": "DESKTOP-5NCFYEU", "ntlmssp.auth.username": "gabriella.ventura" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e35ee49e7535d04e35060595", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 796, "timestamp_epoch": "1582246452.213891000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d2d10e3a0f54ca963257c1a8", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 797, "timestamp_epoch": "1582246452.215166000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1c3ccd294b31fb86c28e0fe8", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 798, "timestamp_epoch": "1582246452.217380000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c62ca9aa56f8f5b87b76708f", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 799, "timestamp_epoch": "1582246452.217717000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ea5902bba0ed2ebc0d1dcdad", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 800, "timestamp_epoch": "1582246452.220450000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f96961977288df4cf5cbf1bd", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 801, "timestamp_epoch": "1582246452.220699000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-da052992b1092994f0ffca83", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 802, "timestamp_epoch": "1582246452.227932000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1022a190c00925c46b7620cf", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 803, "timestamp_epoch": "1582246452.228439000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5e8b6eac318777a186e92920", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 804, "timestamp_epoch": "1582246452.235991000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6e651b9f84b385385f7c8f00", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 805, "timestamp_epoch": "1582246452.236195000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-da8175f0a81f80574d76d419", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 806, "timestamp_epoch": "1582246452.240358000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0a45ab24fdca7e3b06cc15c6", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 807, "timestamp_epoch": "1582246452.240738000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d4b9c72398ef037197e108b8", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 808, "timestamp_epoch": "1582246452.243466000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-336d7617634b45cf45bec517", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 809, "timestamp_epoch": "1582246452.243721000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9e2510789abab0601ed84711", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 810, "timestamp_epoch": "1582246452.244930000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-cc2f87976f7417983dcb9430", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 811, "timestamp_epoch": "1582246452.245395000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1afc547298ddc878714f53cf", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 812, "timestamp_epoch": "1582246452.246938000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-56fe649d99d0762298b2a392", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 813, "timestamp_epoch": "1582246452.247258000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b7ffa34decd3b7b2a26e312a", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 814, "timestamp_epoch": "1582246452.252105000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d2a19a46179dc9cab984c14f", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 815, "timestamp_epoch": "1582246452.252439000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a93c4f0f467b708e2250ba3c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 816, "timestamp_epoch": "1582246452.253406000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8fb6ece57a0e04d5245ceef0", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 817, "timestamp_epoch": "1582246452.253801000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-396a0da566cd0c848e0390e2", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 818, "timestamp_epoch": "1582246452.254816000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5ffff8f2c94a8ef95a7a6143", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 819, "timestamp_epoch": "1582246452.255215000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0f981be8ae1788dcd7f277f0", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 820, "timestamp_epoch": "1582246452.255918000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7f7ef3efa5d24bf59c774209", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 821, "timestamp_epoch": "1582246452.256417000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7fd2ac7496dc51c6db8c0ce5", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 822, "timestamp_epoch": "1582246452.257049000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3c555e1f3b8c0cac5d17957c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 823, "timestamp_epoch": "1582246452.257538000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-27fb767c851955aca38a1f31", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 824, "timestamp_epoch": "1582246452.263816000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "samr.samr_UserInfo21.full_name": "Gabriella Ventura", "samr.samr_UserInfo21.account_name": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-526a2ba5804445c7d7d76085", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 825, "timestamp_epoch": "1582246452.264291000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-bf1ce6fd58f10fe24aff6e98", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 826, "timestamp_epoch": "1582246452.265047000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a3ae9ef6aa69bf6a53bb722b", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 827, "timestamp_epoch": "1582246452.265455000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f90e192e07cd314306d65b29", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 828, "timestamp_epoch": "1582246452.267353000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-bbbf125a6b8c1056fbb7096d", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 829, "timestamp_epoch": "1582246452.267813000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-79a4f82948dc7cb6c751a459", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 830, "timestamp_epoch": "1582246452.269551000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c49c0b51a04055ddb3879ee7", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 831, "timestamp_epoch": "1582246452.269872000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-82651445598337c2103e3484", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1582246452.270287000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f819ca1b164a631e8f541ee8", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 833, "timestamp_epoch": "1582246452.270601000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-591f2326b24a7bfc77e27ea6", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 834, "timestamp_epoch": "1582246452.271503000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-cb05226c95160f217509028c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 835, "timestamp_epoch": "1582246452.271788000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-693e5db48e138d0a2aa557eb", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 836, "timestamp_epoch": "1582246452.272331000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-605e58dd62b44daae8e5829e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 837, "timestamp_epoch": "1582246452.272637000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a62e1eca86095b781890c428", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 841, "timestamp_epoch": "1582246452.274434000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-34c0dabc78e7812302c86433", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 842, "timestamp_epoch": "1582246452.274812000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4e1a2e593d0b8716fb707f56", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 843, "timestamp_epoch": "1582246452.275141000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-76dd4297b4392aefc71499fb", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 844, "timestamp_epoch": "1582246452.275342000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-e50751d89464f98b3cc4e42d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 846, "timestamp_epoch": "1582246452.292888000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9949a5474aee5aae77484891", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 847, "timestamp_epoch": "1582246452.294587000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b9a14e642ebb7e560e1fd176", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 848, "timestamp_epoch": "1582246452.294908000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-61ad7707881e6ef1f8e0af44", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 853, "timestamp_epoch": "1582246452.309416000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6f325c2e8422d21a06dfa986", "src_port": null, "tcp_stream": 42, "udp_stream": null, "frame_number": 856, "timestamp_epoch": "1582246452.310445000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "12,14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-10802d43616dcf79f24fa058", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 865, "timestamp_epoch": "1582246452.312945000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "13", "kerberos.CNameString": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4eae273cd0384485eb9b227d", "src_port": null, "tcp_stream": 43, "udp_stream": null, "frame_number": 868, "timestamp_epoch": "1582246452.313300000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-706be6132fadac4bb9c85189", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 876, "timestamp_epoch": "1582246452.315374000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-96cab281209fa8dca24ab72b", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 878, "timestamp_epoch": "1582246452.317126000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-443240b0a5071d547427c184", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 879, "timestamp_epoch": "1582246452.323915000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d1f86fa348edb7793ec1674b", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 880, "timestamp_epoch": "1582246452.324215000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-21f94246ab0bc4d7c4562d93", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 881, "timestamp_epoch": "1582246452.325186000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a5656829f82f456a38972401", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 882, "timestamp_epoch": "1582246452.325316000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3b9e535d345de0dbb6c002b0", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 883, "timestamp_epoch": "1582246452.327786000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-72308b1423d06df730e19061", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 884, "timestamp_epoch": "1582246452.329058000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ab4c00192ac2e231aa01c19d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 886, "timestamp_epoch": "1582246452.443746000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4f3d346f6245896767e121fc", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 888, "timestamp_epoch": "1582246452.500936000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8f367319c21548614f0ab58a", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 889, "timestamp_epoch": "1582246452.501312000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-527f454258952f5e2195227e", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 894, "timestamp_epoch": "1582246452.515696000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f0c70be6c564df06f487b16d", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 896, "timestamp_epoch": "1582246452.516651000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0c4797b996557c93e7d4c12a", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 903, "timestamp_epoch": "1582246452.531483000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-247b6c7c3710b6ab36b21be7", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 905, "timestamp_epoch": "1582246452.532464000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6f83faea9d826940015f2e5d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1029, "timestamp_epoch": "1582246460.474993000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0514337e5f07352f41681c50", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1030, "timestamp_epoch": "1582246460.475262000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4284eeb9446aad13bd98f61b", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1031, "timestamp_epoch": "1582246460.476438000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-48b8c24d43109047d7179e9a", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1032, "timestamp_epoch": "1582246460.476609000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-71ade74a8772ca12acecbde3", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1037, "timestamp_epoch": "1582246460.991683000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7b9308a913b67adfe22de688", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1038, "timestamp_epoch": "1582246460.992035000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-95d8b05466b138de915a4119", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1039, "timestamp_epoch": "1582246460.992468000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-70f7a9c593583ab988e63233", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1040, "timestamp_epoch": "1582246460.992766000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-49c6c0d98cbf06ddc971cbb9", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1119, "timestamp_epoch": "1582246463.996161000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f3b2bc7e51a4c95fae3da9cf", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1121, "timestamp_epoch": "1582246463.996850000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b3701ab145621029f4b853ba", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1122, "timestamp_epoch": "1582246463.997261000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-61d29e2242cef660502cf974", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1146, "timestamp_epoch": "1582246464.008567000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9840edc3dd8a1769fde76fe1", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1148, "timestamp_epoch": "1582246464.009550000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-766e7bc6923d9a76832b6e46", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1159, "timestamp_epoch": "1582246464.015437000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-15e0617815935e602bac5be0", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1161, "timestamp_epoch": "1582246464.016242000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-fd2554d2a7295cd118558bdc", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1198, "timestamp_epoch": "1582246464.658240000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-fdc216c72ac5e46980bbc5d2", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1200, "timestamp_epoch": "1582246464.659378000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-bf50a911d1b3e613ada21bad", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1205, "timestamp_epoch": "1582246464.675996000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-fff75e246b802f1ec3f068e0", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1206, "timestamp_epoch": "1582246464.676189000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0f76f9208b96d65f3554c950", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1207, "timestamp_epoch": "1582246464.676205000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-cb73b5833336bc286575419a", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 1208, "timestamp_epoch": "1582246464.676376000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8b94360dfca1d7e1b99bd926", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1209, "timestamp_epoch": "1582246464.676631000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-bc91919b41cc82fbe0d9afad", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 1210, "timestamp_epoch": "1582246464.677181000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2df39fecbc504f5581270a6d", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1322, "timestamp_epoch": "1582246503.648251000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-283c6e22231751850316765d", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1324, "timestamp_epoch": "1582246503.649225000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-45857fdf1e99acba8e9cbbbf", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1592, "timestamp_epoch": "1582246513.079472000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-74a167b8b22b0e6e8f1e2b96", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1594, "timestamp_epoch": "1582246513.080482000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ed7476e636a7a2401d8fc925", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1595, "timestamp_epoch": "1582246513.083965000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e2d5fff1821f314577412f12", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1619, "timestamp_epoch": "1582246513.099371000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3ca858851216de04d6f629c6", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1621, "timestamp_epoch": "1582246513.100279000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-27f4f065705790729f4f26e2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1632, "timestamp_epoch": "1582246513.108555000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2687e0fbaff5b76a510a3075", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1634, "timestamp_epoch": "1582246513.110275000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e123e5a201a648ade132e728", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1701, "timestamp_epoch": "1582246550.661830000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9759c0622dfba1cfb9619ac4", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1702, "timestamp_epoch": "1582246552.161911000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-906ad0fa16a82befae303779", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1707, "timestamp_epoch": "1582246553.676106000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-da0dc09cff410c9dc1e60ea1", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1769, "timestamp_epoch": "1582246604.302936000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6fae0014794a0c6a92618e78", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1770, "timestamp_epoch": "1582246604.303685000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-61d40c4888027062075fa461", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1771, "timestamp_epoch": "1582246604.304039000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ef43bc4876ddc7eb095dacef", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1772, "timestamp_epoch": "1582246604.304339000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b53caf1aa19d27234b14b64c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1773, "timestamp_epoch": "1582246604.304629000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6bfa131b8d9b92ed9fbac763", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1774, "timestamp_epoch": "1582246604.304918000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6a48c2675d4820321c5697fa", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1775, "timestamp_epoch": "1582246604.305176000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5a3551f9e857bc0c78d413fe", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1776, "timestamp_epoch": "1582246604.305483000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e72fbfc2020eed0e7e2ad04e", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1778, "timestamp_epoch": "1582246615.068398000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5b1d68526e9b852eb06e1910", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1779, "timestamp_epoch": "1582246615.069094000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-145d4f255d0f5f66e0c62e3c", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1780, "timestamp_epoch": "1582246615.069586000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-63888b1485fa840f067ca236", "src_port": null, "tcp_stream": 1, "udp_stream": null, "frame_number": 1781, "timestamp_epoch": "1582246615.070048000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-017e911e6310207242b5220d", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1788, "timestamp_epoch": "1582246670.663411000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e5da6475bfedf86efcebb1f6", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1789, "timestamp_epoch": "1582246672.208231000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a385f4441ee6439dfa8d4a03", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1790, "timestamp_epoch": "1582246673.741349000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "browser.server": "DESKTOP-TZMKHKC" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3191bb22573d7bf981f9e8f4", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 1791, "timestamp_epoch": "1582246678.029152000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-11f2fb4a8a64313defe7eea8", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1813, "timestamp_epoch": "1582246733.527589000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8567fca0d1e8e6c2679495e2", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1815, "timestamp_epoch": "1582246733.528259000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-23c06da523807f01ea22a957", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1816, "timestamp_epoch": "1582246733.530830000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-60516e88629a2e39514e6dcd", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1840, "timestamp_epoch": "1582246733.549398000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-81e52b4e5715656e06bb83a8", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1842, "timestamp_epoch": "1582246733.550086000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a1ef229f25f426e78c9dd13e", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1853, "timestamp_epoch": "1582246733.554288000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9f2aa646e19a82ecd7bac5ef", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1855, "timestamp_epoch": "1582246733.554929000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-919ba71897cd4eb2fd6ffb8d", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1901, "timestamp_epoch": "1582246790.679234000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-df615dbb945817e5393874da", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1902, "timestamp_epoch": "1582246792.209146000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8c15c22bce90058cf11395ff", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1903, "timestamp_epoch": "1582246793.710823000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-02735deb3fbef4d9af74976d", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1935, "timestamp_epoch": "1582246910.695889000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b999c72f7dcc72d34e647519", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1936, "timestamp_epoch": "1582246912.210847000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-085a4e801411eba481ca86d4", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 1937, "timestamp_epoch": "1582246913.710887000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-18f3d69e03d72322cf8d5774", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2002, "timestamp_epoch": "1582247030.708052000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e95370907b7c2d6fbfad7349", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2004, "timestamp_epoch": "1582247032.238185000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-268c6840c2e0301ee75be072", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 2005, "timestamp_epoch": "1582247032.301440000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9196ac8f0ca6e8e8ed8f967d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 2006, "timestamp_epoch": "1582247032.302037000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2a3aa780f005cd119cd174bc", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2034, "timestamp_epoch": "1582247033.754289000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3200b97cd1ca48e896892c4e", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2179, "timestamp_epoch": "1582247150.738387000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-84901b70048e96db00717fa8", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2180, "timestamp_epoch": "1582247152.239905000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-78a1ed050d2c4a74027f9619", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2183, "timestamp_epoch": "1582247153.755985000" }, { "kind": "identity", "dst_ip": "172.17.8.255", "fields": { "eth.dst": "ff:ff:ff:ff:ff:ff", "eth.src": "00:11:75:8c:fd:47", "browser.server": "DESKTOP-TZMKHKC" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-21d49fa66a26d2dbe01aa64f", "src_port": null, "tcp_stream": null, "udp_stream": 33, "frame_number": 2184, "timestamp_epoch": "1582247157.859759000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f6d61afbe6e76a1b11179842", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2210, "timestamp_epoch": "1582247270.754984000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-feada107df8146361d401795", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2211, "timestamp_epoch": "1582247272.254890000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d0f543afffa8110261b4f928", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2214, "timestamp_epoch": "1582247273.756506000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b1be5e29f36278f6ca7eeaa7", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2215, "timestamp_epoch": "1582247330.044515000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:75:8c:fd:47", "dns.qry.name": "DESKTOP-TZMKHKC.local" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-05d50312434d713abca1d46e", "src_port": null, "tcp_stream": null, "udp_stream": 2, "frame_number": 2223, "timestamp_epoch": "1582247330.056797000" }, { "kind": "identity", "dst_ip": "224.0.0.251", "fields": { "eth.dst": "01:00:5e:00:00:fb", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-472ca10a63f68b67e5653be5", "src_port": null, "tcp_stream": null, "udp_stream": 2, "frame_number": 2224, "timestamp_epoch": "1582247330.057090000" }, { "kind": "identity", "dst_ip": "224.0.0.252", "fields": { "eth.dst": "01:00:5e:00:00:fc", "eth.src": "00:11:75:8c:fd:47", "dns.qry.name": "DESKTOP-TZMKHKC" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b81bff20905fb033a222ac89", "src_port": null, "tcp_stream": null, "udp_stream": 67, "frame_number": 2225, "timestamp_epoch": "1582247330.057241000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8008af10b4a0f151ff66d042", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2228, "timestamp_epoch": "1582247331.568639000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-10ba048df3f14cfb95119ae9", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2233, "timestamp_epoch": "1582247332.480524000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7689cece1e2b3614219472f8", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2234, "timestamp_epoch": "1582247332.480759000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-128b1d7418754f098ccf3fcc", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2235, "timestamp_epoch": "1582247332.481136000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47", "kerberos.msg_type": "14" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7ebbac1d61eb6e94e2e9dec5", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2238, "timestamp_epoch": "1582247332.482304000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a", "kerberos.msg_type": "15" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7d5884556826c7dfda8ad76d", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2240, "timestamp_epoch": "1582247332.484065000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4d1b84bcb1155b72bfb99896", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2241, "timestamp_epoch": "1582247332.484604000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-576d71cdc93286f86e145d6c", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2242, "timestamp_epoch": "1582247332.484788000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d7e5d382d17fa7b275d68c3c", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2243, "timestamp_epoch": "1582247332.485001000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d92baa778bb6d607c13bb19a", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2244, "timestamp_epoch": "1582247332.485131000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-cd00d21a7a6245b6632c4094", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2245, "timestamp_epoch": "1582247332.485179000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-162b25181d3b18d8d1c0bd25", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2246, "timestamp_epoch": "1582247332.485476000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-59b4c98d02b307d7fff76c10", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 2248, "timestamp_epoch": "1582247333.114652000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-75f4af041af26ddb5494b8b9", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2313, "timestamp_epoch": "1582247343.208842000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-82c03a45d19370b56a4d53e9", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2314, "timestamp_epoch": "1582247343.209145000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ea040597ce2c26b473a6aa3e", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2315, "timestamp_epoch": "1582247343.218830000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3b5bc7dba9299e34c963a742", "src_port": null, "tcp_stream": 81, "udp_stream": null, "frame_number": 2316, "timestamp_epoch": "1582247343.219071000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-01c87033a5e6ee5793304bfb", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 4412, "timestamp_epoch": "1582247450.039556000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-bfd65fb60fbdee1594a1963e", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 4413, "timestamp_epoch": "1582247451.553938000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-888dbd2113652ff099df910a", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 4414, "timestamp_epoch": "1582247453.069895000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a57cf04dbc42aa749ad4eec9", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5465, "timestamp_epoch": "1582247520.495794000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-95474358a922f0c1e775c8ef", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5466, "timestamp_epoch": "1582247520.496275000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-434976862e16943e046adbfe", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5467, "timestamp_epoch": "1582247520.510700000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5572ab9505de454083eea7c0", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5468, "timestamp_epoch": "1582247520.511158000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f8af1f6bfda2b294d0ca176d", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5470, "timestamp_epoch": "1582247521.162577000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-84dd86830e9c740ddc7358e9", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5471, "timestamp_epoch": "1582247521.162801000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a9bbbb2d44dfedeaefbdd5b1", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5472, "timestamp_epoch": "1582247521.172416000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-81e72f11cfa1c0a252b1e020", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5473, "timestamp_epoch": "1582247521.172614000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3d145d9ab108a8e24d4ea4b0", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 5512, "timestamp_epoch": "1582247570.056017000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5a3a77b3890f9faaa1ad942e", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 5513, "timestamp_epoch": "1582247571.571204000" }, { "kind": "identity", "dst_ip": "172.17.8.1", "fields": { "eth.dst": "20:e5:2a:b6:93:f1", "eth.src": "00:11:75:8c:fd:47", "nbns.name": "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)", "nbns.flags.opcode": "8", "nbns.flags.response": "False", "nbns.nb_flags.group": "False" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-096a26e8088062ae82c8efd3", "src_port": null, "tcp_stream": null, "udp_stream": 12, "frame_number": 5514, "timestamp_epoch": "1582247573.086466000" }, { "kind": "identity", "dst_ip": "172.17.8.8", "fields": { "eth.dst": "a4:1f:72:c2:09:6a", "eth.src": "00:11:75:8c:fd:47" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d4f95a158784662e2c244461", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5517, "timestamp_epoch": "1582247632.666220000" }, { "kind": "identity", "dst_ip": "172.17.8.174", "fields": { "eth.dst": "00:11:75:8c:fd:47", "eth.src": "a4:1f:72:c2:09:6a" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-dd9fd1c7ad3743ea533e86d8", "src_port": null, "tcp_stream": 41, "udp_stream": null, "frame_number": 5518, "timestamp_epoch": "1582247632.666866000" } ], "http_request": [ { "kind": "http_request", "dst_ip": "49.51.172.56", "fields": { "http.host": "blueflag.xyz", "http.user_agent": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)", "http.request.uri": "/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin", "http.response_in": "1566", "http.request.method": "GET", "http.request.full_uri": "http://blueflag.xyz/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-260c10fbc306af61a3bd1393", "src_port": 49731, "tcp_stream": 60, "udp_stream": null, "frame_number": 1340, "timestamp_epoch": "1582246506.703102000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash", "http.response_in": "5767", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-09185cc918973daae9b06dac", "src_port": 49779, "tcp_stream": 109, "udp_stream": null, "frame_number": 5753, "timestamp_epoch": "1582247647.389889000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d", "http.response_in": "5813", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-887dfef183c5900573a96fc0", "src_port": 49784, "tcp_stream": 114, "udp_stream": null, "frame_number": 5804, "timestamp_epoch": "1582247647.791570000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d", "http.response_in": "5812", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-84c61df3faf27dc7f461a257", "src_port": 49785, "tcp_stream": 115, "udp_stream": null, "frame_number": 5806, "timestamp_epoch": "1582247647.791739000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d", "http.response_in": "5816", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-4d37b63cf468511a74ffc577", "src_port": 49782, "tcp_stream": 112, "udp_stream": null, "frame_number": 5808, "timestamp_epoch": "1582247647.791889000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d", "http.response_in": "5820", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-d1311bec866b0691489702da", "src_port": 49783, "tcp_stream": 113, "udp_stream": null, "frame_number": 5810, "timestamp_epoch": "1582247647.792050000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "http.response_in": "5890", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-911a26c5f48f4ea76ee71b82", "src_port": 49787, "tcp_stream": 117, "udp_stream": null, "frame_number": 5870, "timestamp_epoch": "1582247648.842040000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "http.response_in": "5891", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-8fd39a0fac783a03549611ca", "src_port": 49788, "tcp_stream": 118, "udp_stream": null, "frame_number": 5880, "timestamp_epoch": "1582247648.853066000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "http.response_in": "5892", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-56ca0a5c1ad40c358f5a8b1a", "src_port": 49789, "tcp_stream": 119, "udp_stream": null, "frame_number": 5882, "timestamp_epoch": "1582247648.853312000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "http.response_in": "5893", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-7a7467511f9bea149f469cc6", "src_port": 49790, "tcp_stream": 120, "udp_stream": null, "frame_number": 5884, "timestamp_epoch": "1582247648.853546000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "http.response_in": "7394", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-7ae44704c0d79cce855e2a74", "src_port": 49790, "tcp_stream": 120, "udp_stream": null, "frame_number": 5894, "timestamp_epoch": "1582247648.964297000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "http.response_in": "6653", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-d37bee50d6440989fb7bc783", "src_port": 49787, "tcp_stream": 117, "udp_stream": null, "frame_number": 5896, "timestamp_epoch": "1582247648.974578000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash", "http.response_in": "6773", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-8476351d7853ba83fc307ee1", "src_port": 49792, "tcp_stream": 122, "udp_stream": null, "frame_number": 6576, "timestamp_epoch": "1582247649.446551000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "http.response_in": "7396", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-5b83ab83c1f8b9f74771df1e", "src_port": 49794, "tcp_stream": 124, "udp_stream": null, "frame_number": 7066, "timestamp_epoch": "1582247649.678232000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "http.response_in": "7395", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-e87ee105afac2f7316d1873b", "src_port": 49795, "tcp_stream": 125, "udp_stream": null, "frame_number": 7069, "timestamp_epoch": "1582247649.678457000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "http.response_in": "8133", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-d4617cd8829628056298d29d", "src_port": 49795, "tcp_stream": 125, "udp_stream": null, "frame_number": 7398, "timestamp_epoch": "1582247649.844921000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash", "http.response_in": "7492", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-69596942bb85e29989080634", "src_port": 49796, "tcp_stream": 126, "udp_stream": null, "frame_number": 7409, "timestamp_epoch": "1582247649.954012000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "http.response_in": "7957", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-3cfab1d3a05bee5027bbfc3e", "src_port": 49798, "tcp_stream": 128, "udp_stream": null, "frame_number": 7710, "timestamp_epoch": "1582247650.216638000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "http.response_in": "8053", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-e888ae71be0316d6a1bc024b", "src_port": 49797, "tcp_stream": 127, "udp_stream": null, "frame_number": 7720, "timestamp_epoch": "1582247650.216920000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "http.response_in": "8906", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-7a23d6cd6476a3095691c94f", "src_port": 49798, "tcp_stream": 128, "udp_stream": null, "frame_number": 7969, "timestamp_epoch": "1582247650.353753000" }, { "kind": "http_request", "dst_ip": "13.107.4.50", "fields": { "http.host": "dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash", "http.response_in": "8939", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-94cb9d458ddf0298db048800", "src_port": 49800, "tcp_stream": 130, "udp_stream": null, "frame_number": 8927, "timestamp_epoch": "1582247651.329111000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "http.response_in": "8973", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-87bb094950402b0b4bd6a8ac", "src_port": 49801, "tcp_stream": 131, "udp_stream": null, "frame_number": 8949, "timestamp_epoch": "1582247651.480063000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "http.response_in": "8974", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-2a190a2989314563b68cc757", "src_port": 49802, "tcp_stream": 132, "udp_stream": null, "frame_number": 8951, "timestamp_epoch": "1582247651.480147000" }, { "kind": "http_request", "dst_ip": "205.185.216.10", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d", "http.response_in": "8982", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-809beb801316ea18b7d04010", "src_port": 49803, "tcp_stream": 133, "udp_stream": null, "frame_number": 8959, "timestamp_epoch": "1582247651.530518000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d", "http.response_in": "8981", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-45822cc6cd7fdad023ecf3b2", "src_port": 49804, "tcp_stream": 134, "udp_stream": null, "frame_number": 8961, "timestamp_epoch": "1582247651.530634000" }, { "kind": "http_request", "dst_ip": "23.1.236.114", "fields": { "http.host": "2.tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "http.response_in": "9002", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-d17f42e3e293d9b6e4923d45", "src_port": 49805, "tcp_stream": 135, "udp_stream": null, "frame_number": 8989, "timestamp_epoch": "1582247651.642417000" }, { "kind": "http_request", "dst_ip": "23.1.236.92", "fields": { "http.host": "2.tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "http.response_in": "9001", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-b30aabff9c37d8bfec9d7de1", "src_port": 49806, "tcp_stream": 136, "udp_stream": null, "frame_number": 8991, "timestamp_epoch": "1582247651.642504000" }, { "kind": "http_request", "dst_ip": "205.185.216.42", "fields": { "http.host": "tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-d89fa72b8d828fc01613f9a5", "src_port": 49807, "tcp_stream": 137, "udp_stream": null, "frame_number": 8999, "timestamp_epoch": "1582247651.700292000" }, { "kind": "http_request", "dst_ip": "23.1.236.92", "fields": { "http.host": "2.tlu.dl.delivery.mp.microsoft.com", "http.user_agent": "Microsoft-Delivery-Optimization/10.0", "http.request.uri": "/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "http.content_length": "0", "http.request.method": "GET", "http.request.full_uri": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d" }, "src_ip": "172.17.8.174", "dst_port": 80, "event_id": "evt-236600e7a2daa9c5ed2bbc43", "src_port": 49806, "tcp_stream": 136, "udp_stream": null, "frame_number": 9003, "timestamp_epoch": "1582247651.737305000" } ], "http_response": [ { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "1340", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "208896" }, "src_ip": "49.51.172.56", "dst_port": 49731, "event_id": "evt-b8172d2f1ca246746840709a", "src_port": 80, "tcp_stream": 60, "udp_stream": null, "body_sha256": "03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066", "frame_number": 1566, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 208896, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 208896, "timestamp_epoch": "1582246508.624645000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5753", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "293" }, "src_ip": "13.107.4.50", "dst_port": 49779, "event_id": "evt-1bd9f6af385d8210a7c27835", "src_port": 80, "tcp_stream": 109, "udp_stream": null, "body_sha256": "7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48", "frame_number": 5767, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 293, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 293, "timestamp_epoch": "1582247647.497481000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5806", "http.response.code": "403", "http.content_length": "0" }, "src_ip": "205.185.216.10", "dst_port": 49785, "event_id": "evt-9c7a9fe166446cfa2c93e700", "src_port": 80, "tcp_stream": 115, "udp_stream": null, "frame_number": 5812, "timestamp_epoch": "1582247647.895266000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5804", "http.response.code": "403", "http.content_length": "0" }, "src_ip": "205.185.216.42", "dst_port": 49784, "event_id": "evt-dba9d851d830a5ceba962222", "src_port": 80, "tcp_stream": 114, "udp_stream": null, "frame_number": 5813, "timestamp_epoch": "1582247647.895320000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5808", "http.response.code": "403", "http.content_length": "0" }, "src_ip": "205.185.216.42", "dst_port": 49782, "event_id": "evt-8213f336a9c1b9928795b3cc", "src_port": 80, "tcp_stream": 112, "udp_stream": null, "frame_number": 5816, "timestamp_epoch": "1582247647.895992000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5810", "http.response.code": "403", "http.content_length": "0" }, "src_ip": "205.185.216.10", "dst_port": 49783, "event_id": "evt-cb2731d35cb3c1585a5383ec", "src_port": 80, "tcp_stream": 113, "udp_stream": null, "frame_number": 5820, "timestamp_epoch": "1582247647.901712000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5870", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.42", "dst_port": 49787, "event_id": "evt-d16cab0c066278c12314eb8c", "src_port": 80, "tcp_stream": 117, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 5890, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247648.960052000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5880", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.10", "dst_port": 49788, "event_id": "evt-97957119a0cf0530d53dadd4", "src_port": 80, "tcp_stream": 118, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 5891, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247648.960119000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5882", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.42", "dst_port": 49789, "event_id": "evt-8775b08e46171db4511ddfca", "src_port": 80, "tcp_stream": 119, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 5892, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247648.960131000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5884", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.10", "dst_port": 49790, "event_id": "evt-aa53c21640b0833a0dda31f8", "src_port": 80, "tcp_stream": 120, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 5893, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247648.960138000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5896", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "519620" }, "src_ip": "205.185.216.42", "dst_port": 49787, "event_id": "evt-f432672e515c1de103a6b94f", "src_port": 80, "tcp_stream": 117, "udp_stream": null, "body_sha256": "6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc", "frame_number": 6653, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 519620, "timestamp_epoch": "1582247649.464172000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "6576", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "198" }, "src_ip": "13.107.4.50", "dst_port": 49792, "event_id": "evt-a36d61f2dedeed7dd3023417", "src_port": 80, "tcp_stream": 122, "udp_stream": null, "body_sha256": "166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e", "frame_number": 6773, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 198, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 198, "timestamp_epoch": "1582247649.565924000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "5894", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "791389" }, "src_ip": "205.185.216.10", "dst_port": 49790, "event_id": "evt-3701637d0a11e01cffad2d60", "src_port": 80, "tcp_stream": 120, "udp_stream": null, "body_sha256": "bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0", "frame_number": 7394, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 791389, "timestamp_epoch": "1582247649.805032000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7069", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.42", "dst_port": 49795, "event_id": "evt-f2c19f98c428072d273a7e0a", "src_port": 80, "tcp_stream": 125, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 7395, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247649.805067000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7066", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.10", "dst_port": 49794, "event_id": "evt-29d6122a1dd1a122ed642de7", "src_port": 80, "tcp_stream": 124, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 7396, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247649.805075000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7409", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "1328" }, "src_ip": "13.107.4.50", "dst_port": 49796, "event_id": "evt-66d7bdafccc1d7c8a5fd4233", "src_port": 80, "tcp_stream": 126, "udp_stream": null, "body_sha256": "a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961", "frame_number": 7492, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1328, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1328, "timestamp_epoch": "1582247650.050844000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7710", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.42", "dst_port": 49798, "event_id": "evt-6fc408f520d0afaa92c6773e", "src_port": 80, "tcp_stream": 128, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 7957, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247650.349044000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7720", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.10", "dst_port": 49797, "event_id": "evt-8a73dbd54b855dffb910b4cb", "src_port": 80, "tcp_stream": 127, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 8053, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247650.385852000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7398", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "629753" }, "src_ip": "205.185.216.42", "dst_port": 49795, "event_id": "evt-8e19d065c1c0d68db59e7178", "src_port": 80, "tcp_stream": 125, "udp_stream": null, "body_sha256": "9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86", "frame_number": 8133, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 629753, "timestamp_epoch": "1582247650.409278000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "7969", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "659511" }, "src_ip": "205.185.216.42", "dst_port": 49798, "event_id": "evt-5e476fdb9d81bd02ef935844", "src_port": 80, "tcp_stream": 128, "udp_stream": null, "body_sha256": "647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78", "frame_number": 8906, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 659511, "timestamp_epoch": "1582247651.003698000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8927", "http.content_type": "application/octet-stream", "http.response.code": "200", "http.content_length": "1140" }, "src_ip": "13.107.4.50", "dst_port": 49800, "event_id": "evt-e488e6d2b1f1a3bca10542f8", "src_port": 80, "tcp_stream": 130, "udp_stream": null, "body_sha256": "f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513", "frame_number": 8939, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1140, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 1140, "timestamp_epoch": "1582247651.438566000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8949", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.42", "dst_port": 49801, "event_id": "evt-a2566046f0e07e93789e441a", "src_port": 80, "tcp_stream": 131, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 8973, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247651.589879000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8951", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "205.185.216.10", "dst_port": 49802, "event_id": "evt-bdd40c5906e407ea01a55d24", "src_port": 80, "tcp_stream": 132, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 8974, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247651.589890000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8961", "http.response.code": "403", "http.content_length": "0" }, "src_ip": "205.185.216.42", "dst_port": 49804, "event_id": "evt-fd6f5754daa84ddd5d6ab7ac", "src_port": 80, "tcp_stream": 134, "udp_stream": null, "frame_number": 8981, "timestamp_epoch": "1582247651.634497000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8959", "http.response.code": "403", "http.content_length": "0" }, "src_ip": "205.185.216.10", "dst_port": 49803, "event_id": "evt-8b88d21f40182733ea474196", "src_port": 80, "tcp_stream": 133, "udp_stream": null, "frame_number": 8982, "timestamp_epoch": "1582247651.634942000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8991", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "23.1.236.92", "dst_port": 49806, "event_id": "evt-1ead1113bd30321405f37d19", "src_port": 80, "tcp_stream": 136, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 9001, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247651.729632000" }, { "kind": "http_response", "dst_ip": "172.17.8.174", "fields": { "http.request_in": "8989", "http.content_type": "application/octet-stream", "http.response.code": "206", "http.content_length": "2" }, "src_ip": "23.1.236.114", "dst_port": 49805, "event_id": "evt-0f81a576987e6bc50d4659ac", "src_port": 80, "tcp_stream": 135, "udp_stream": null, "body_sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "frame_number": 9002, "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "body_size_bytes": 2, "timestamp_epoch": "1582247651.729665000" } ], "tls_client_hello": [ { "kind": "tls_client_hello", "dst_ip": "52.114.132.22", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-f8711caad4fb3a725f35d7f5", "src_port": 49705, "tcp_stream": 34, "udp_stream": null, "frame_number": 681, "timestamp_epoch": "1582246443.186153000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-515efccca2a185e5a68b4fc5", "src_port": 49717, "tcp_stream": 46, "udp_stream": null, "frame_number": 940, "timestamp_epoch": "1582246457.813124000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-8694cc6d44c62d5ce7b7fbb5", "src_port": 49718, "tcp_stream": 47, "udp_stream": null, "frame_number": 941, "timestamp_epoch": "1582246457.813278000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.4.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "c-ring.msedge.net" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-9421a8b23c73dbd22e26ebcf", "src_port": 49720, "tcp_stream": 49, "udp_stream": null, "frame_number": 946, "timestamp_epoch": "1582246457.920620000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.139", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "ow1.res.office365.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-ea4559be4487d8ad67cfa4aa", "src_port": 49719, "tcp_stream": 48, "udp_stream": null, "frame_number": 950, "timestamp_epoch": "1582246457.925669000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "s-ring.msedge.net" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-45eda5c199947cc6ef5ab95b", "src_port": 49721, "tcp_stream": 50, "udp_stream": null, "frame_number": 1043, "timestamp_epoch": "1582246461.020773000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-166e3bed62bb65debf1e0b6f", "src_port": 49722, "tcp_stream": 51, "udp_stream": null, "frame_number": 1065, "timestamp_epoch": "1582246462.267652000" }, { "kind": "tls_client_hello", "dst_ip": "40.126.5.35", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "login.microsoftonline.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-0b3a7e6e4fdab3125505959b", "src_port": 49727, "tcp_stream": 56, "udp_stream": null, "frame_number": 1188, "timestamp_epoch": "1582246464.628719000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.128.9", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-1c31201780113cdc7c2240f1", "src_port": 49729, "tcp_stream": 58, "udp_stream": null, "frame_number": 1238, "timestamp_epoch": "1582246474.230432000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.76.34", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-788c66212808682bf68e7076", "src_port": 49732, "tcp_stream": 61, "udp_stream": null, "frame_number": 1579, "timestamp_epoch": "1582246513.012628000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-ceb09cffe01fa5ca4de911ba", "src_port": 49737, "tcp_stream": 67, "udp_stream": null, "frame_number": 1713, "timestamp_epoch": "1582246560.763316000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.124.20", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "nexusrules.officeapps.live.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-0b98cc36a73b1c3a63096f5f", "src_port": 49738, "tcp_stream": 68, "udp_stream": null, "frame_number": 1748, "timestamp_epoch": "1582246585.130250000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.132.22", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-55274025fa949f93b4049ea4", "src_port": 49743, "tcp_stream": 73, "udp_stream": null, "frame_number": 1876, "timestamp_epoch": "1582246763.360785000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.76.34", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-c1525a811d5709a263d1594d", "src_port": 49744, "tcp_stream": 74, "udp_stream": null, "frame_number": 1909, "timestamp_epoch": "1582246869.204521000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.246.10", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "pti.store.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-b703be5a7d61a76a18319731", "src_port": 49745, "tcp_stream": 75, "udp_stream": null, "frame_number": 1948, "timestamp_epoch": "1582246971.593434000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-0320f89f1f542af8503ac104", "src_port": 49746, "tcp_stream": 76, "udp_stream": null, "frame_number": 1960, "timestamp_epoch": "1582246971.714412000" }, { "kind": "tls_client_hello", "dst_ip": "52.230.222.68", "fields": { "tls.handshake.ja3": "3b5074b1b5d032e5620f69f9f700ff0e", "tls.handshake.extensions_server_name": "client.wns.windows.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-ce2a72c4fa3ce8c9af3b057d", "src_port": 49747, "tcp_stream": 77, "udp_stream": null, "frame_number": 2012, "timestamp_epoch": "1582247032.579213000" }, { "kind": "tls_client_hello", "dst_ip": "40.91.116.226", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe2cr.update.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-20a7d5e817a84cc06c8266ac", "src_port": 49748, "tcp_stream": 78, "udp_stream": null, "frame_number": 2040, "timestamp_epoch": "1582247035.048224000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.18", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-8c6334f39d828991a3f508e0", "src_port": 49749, "tcp_stream": 79, "udp_stream": null, "frame_number": 2126, "timestamp_epoch": "1582247037.155452000" }, { "kind": "tls_client_hello", "dst_ip": "52.114.76.34", "fields": { "tls.handshake.ja3": "37f463bf4616ecd445d4a1937da06e19", "tls.handshake.extensions_server_name": "self.events.data.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-a9e1ba30c338035d77889c46", "src_port": 49750, "tcp_stream": 80, "udp_stream": null, "frame_number": 2188, "timestamp_epoch": "1582247183.152269000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.18", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-6c9dc05af99c975c48013336", "src_port": 49752, "tcp_stream": 82, "udp_stream": null, "frame_number": 2254, "timestamp_epoch": "1582247334.327265000" }, { "kind": "tls_client_hello", "dst_ip": "52.109.2.55", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "mrodevicemgr.officeapps.live.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-4a5f56c7264e00e94ad07281", "src_port": 49753, "tcp_stream": 83, "udp_stream": null, "frame_number": 2325, "timestamp_epoch": "1582247354.882140000" }, { "kind": "tls_client_hello", "dst_ip": "23.54.20.119", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "officecdn.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-77d677bfd2ca236d56e62ffe", "src_port": 49754, "tcp_stream": 84, "udp_stream": null, "frame_number": 2357, "timestamp_epoch": "1582247355.986585000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-e7c05213875c32ea2956d7fe", "src_port": 49755, "tcp_stream": 85, "udp_stream": null, "frame_number": 3221, "timestamp_epoch": "1582247357.771214000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-8af567df32b0b60852ae57c6", "src_port": 49759, "tcp_stream": 89, "udp_stream": null, "frame_number": 3381, "timestamp_epoch": "1582247358.014663000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-406be0a1da08335bede32618", "src_port": 49758, "tcp_stream": 88, "udp_stream": null, "frame_number": 3383, "timestamp_epoch": "1582247358.014928000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-0a4adc2c67394647833b6412", "src_port": 49757, "tcp_stream": 87, "udp_stream": null, "frame_number": 3385, "timestamp_epoch": "1582247358.015171000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.128", "fields": { "tls.handshake.ja3": "a0e9f5d64349fb13191bc781f81f42e1", "tls.handshake.extensions_server_name": "config.edge.skype.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-14ac683d6ddeec1e45375bde", "src_port": 49756, "tcp_stream": 86, "udp_stream": null, "frame_number": 3432, "timestamp_epoch": "1582247358.016098000" }, { "kind": "tls_client_hello", "dst_ip": "91.211.88.122", "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-ab0b78515e2843d377cb55ff", "src_port": 49760, "tcp_stream": 90, "udp_stream": null, "frame_number": 4422, "timestamp_epoch": "1582247508.600095000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.222", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "fp.msedge.net" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-fb73262a0385569e94637421", "src_port": 49761, "tcp_stream": 91, "udp_stream": null, "frame_number": 4441, "timestamp_epoch": "1582247509.910153000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "www.bing.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-ace8d236c76cedd8f1afb60d", "src_port": 49762, "tcp_stream": 92, "udp_stream": null, "frame_number": 4472, "timestamp_epoch": "1582247510.448404000" }, { "kind": "tls_client_hello", "dst_ip": "91.211.88.122", "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-8ceda54a48510bc0b512ca1a", "src_port": 49763, "tcp_stream": 93, "udp_stream": null, "frame_number": 4500, "timestamp_epoch": "1582247511.654130000" }, { "kind": "tls_client_hello", "dst_ip": "13.107.3.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "s-ring.msedge.net" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-7a3ec13a0ea30dd70fcc3914", "src_port": 49764, "tcp_stream": 94, "udp_stream": null, "frame_number": 4513, "timestamp_epoch": "1582247512.351164000" }, { "kind": "tls_client_hello", "dst_ip": "72.21.81.200", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "fp-vp.azureedge.net" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-79f01acd4f16b268eaec776d", "src_port": 49765, "tcp_stream": 95, "udp_stream": null, "frame_number": 4557, "timestamp_epoch": "1582247513.153657000" }, { "kind": "tls_client_hello", "dst_ip": "204.79.197.254", "fields": { "tls.handshake.ja3": "9e10692f1b7f78228b2d4e424db3a98c", "tls.handshake.extensions_server_name": "a-ring.msedge.net" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-fd16f4be3d7e08ba08372168", "src_port": 49766, "tcp_stream": 96, "udp_stream": null, "frame_number": 4716, "timestamp_epoch": "1582247513.910345000" }, { "kind": "tls_client_hello", "dst_ip": "91.211.88.122", "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-5edcec465ae82519c4086f26", "src_port": 49767, "tcp_stream": 97, "udp_stream": null, "frame_number": 5435, "timestamp_epoch": "1582247516.365288000" }, { "kind": "tls_client_hello", "dst_ip": "91.211.88.122", "fields": { "tls.handshake.ja3": "51c64c77e60f3980eea90869b68c58a8" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-16f2aac657159fafbcefa53d", "src_port": 49770, "tcp_stream": 100, "udp_stream": null, "frame_number": 5478, "timestamp_epoch": "1582247523.123786000" }, { "kind": "tls_client_hello", "dst_ip": "52.159.17.76", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "tsfe.trafficshaping.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-b81eae949a8ae31c21f6def9", "src_port": 49771, "tcp_stream": 101, "udp_stream": null, "frame_number": 5530, "timestamp_epoch": "1582247642.109241000" }, { "kind": "tls_client_hello", "dst_ip": "52.159.17.76", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "tsfe.trafficshaping.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-86d38c254e74de521fa5fd86", "src_port": 49772, "tcp_stream": 102, "udp_stream": null, "frame_number": 5562, "timestamp_epoch": "1582247642.888828000" }, { "kind": "tls_client_hello", "dst_ip": "52.159.17.76", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "tsfe.trafficshaping.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-69a7608fbdfbf8210f1fc3c4", "src_port": 49773, "tcp_stream": 103, "udp_stream": null, "frame_number": 5599, "timestamp_epoch": "1582247643.679977000" }, { "kind": "tls_client_hello", "dst_ip": "40.69.216.73", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "geo.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-fe2af2821665a43e29ab0555", "src_port": 49774, "tcp_stream": 104, "udp_stream": null, "frame_number": 5639, "timestamp_epoch": "1582247644.789630000" }, { "kind": "tls_client_hello", "dst_ip": "104.77.69.193", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "kv601.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-74fcf29c9106d7247359469c", "src_port": 49775, "tcp_stream": 105, "udp_stream": null, "frame_number": 5663, "timestamp_epoch": "1582247646.082972000" }, { "kind": "tls_client_hello", "dst_ip": "104.77.69.193", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp601.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-81669da111452e0514150121", "src_port": 49776, "tcp_stream": 106, "udp_stream": null, "frame_number": 5690, "timestamp_epoch": "1582247646.762451000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.18", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-99743eea064ea4f8432543c3", "src_port": 49777, "tcp_stream": 107, "udp_stream": null, "frame_number": 5700, "timestamp_epoch": "1582247646.920312000" }, { "kind": "tls_client_hello", "dst_ip": "104.77.69.193", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp601.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-86b7eae831aa846aec47c48a", "src_port": 49778, "tcp_stream": 108, "udp_stream": null, "frame_number": 5740, "timestamp_epoch": "1582247647.292513000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.18", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-e7f2e16b03219ef5205345bd", "src_port": 49786, "tcp_stream": 116, "udp_stream": null, "frame_number": 5833, "timestamp_epoch": "1582247648.157623000" }, { "kind": "tls_client_hello", "dst_ip": "104.77.69.193", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp601.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-cf9485b23d0d03792fa76b9f", "src_port": 49791, "tcp_stream": 121, "udp_stream": null, "frame_number": 5888, "timestamp_epoch": "1582247648.942106000" }, { "kind": "tls_client_hello", "dst_ip": "104.77.69.193", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp601.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-ee55dae6b129160d39a1724a", "src_port": 49793, "tcp_stream": 123, "udp_stream": null, "frame_number": 6610, "timestamp_epoch": "1582247649.455036000" }, { "kind": "tls_client_hello", "dst_ip": "104.77.69.193", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "cp601.prod.do.dsp.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-e99aa2fda44dcad88a98a8cf", "src_port": 49799, "tcp_stream": 129, "udp_stream": null, "frame_number": 8498, "timestamp_epoch": "1582247650.811535000" }, { "kind": "tls_client_hello", "dst_ip": "64.4.54.18", "fields": { "tls.handshake.ja3": "28a2c9bd18a11de089ef85a160da29e4", "tls.handshake.extensions_server_name": "fe3cr.delivery.mp.microsoft.com" }, "src_ip": "172.17.8.174", "dst_port": 443, "event_id": "evt-169f7c501c31796dea1fe329", "src_port": 49808, "tcp_stream": 138, "udp_stream": null, "frame_number": 9102, "timestamp_epoch": "1582247651.865502000" } ], "unclassified_tcp": [ { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-1388d21e6b3ac3e4ed13d534", "src_port": 49671, "tcp_stream": 1, "udp_stream": null, "frame_number": 1231, "timestamp_epoch": "1582246473.207747000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-11e7d1a3cce7b4113cbd6997", "src_port": 49712, "tcp_stream": 41, "udp_stream": null, "frame_number": 1296, "timestamp_epoch": "1582246494.692315000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-b2518dc5f91b237a011ef5f6", "src_port": 49671, "tcp_stream": 1, "udp_stream": null, "frame_number": 1312, "timestamp_epoch": "1582246503.223050000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-5768e5ec1a9466b15a8d3ded", "src_port": 49712, "tcp_stream": 41, "udp_stream": null, "frame_number": 1695, "timestamp_epoch": "1582246524.707710000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-f170c20f27e5dff6f17bf3a1", "src_port": 49671, "tcp_stream": 1, "udp_stream": null, "frame_number": 1699, "timestamp_epoch": "1582246533.240218000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49671, "event_id": "evt-916cc2069885cff0e3339c70", "src_port": 445, "tcp_stream": 1, "udp_stream": null, "frame_number": 1737, "timestamp_epoch": "1582246563.253434000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-6b7790fc0acdb88b4801c1e6", "src_port": 49671, "tcp_stream": 1, "udp_stream": null, "frame_number": 1739, "timestamp_epoch": "1582246563.254378000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-9db7168d581f285c44fffc22", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 1742, "timestamp_epoch": "1582246584.737415000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-4b8a5d5e1f5a23588050d1a5", "src_port": 49671, "tcp_stream": 1, "udp_stream": null, "frame_number": 1766, "timestamp_epoch": "1582246593.255709000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-ebbacd4c0f941e13d3dd0a0e", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 1796, "timestamp_epoch": "1582246704.753628000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-d2834c7538a65c0853a02333", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 1904, "timestamp_epoch": "1582246824.755560000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-3a7d74fcb8cbd149338c2bf4", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 1938, "timestamp_epoch": "1582246944.767195000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-7f1e58d1c570761c74d67612", "src_port": 49712, "tcp_stream": 41, "udp_stream": null, "frame_number": 2171, "timestamp_epoch": "1582247062.305469000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-80bc4966a22975512e26680e", "src_port": 49712, "tcp_stream": 41, "udp_stream": null, "frame_number": 2173, "timestamp_epoch": "1582247092.317915000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-c6de315c6c4954196409106f", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 2181, "timestamp_epoch": "1582247152.362452000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-d15f73258fff513d152772fe", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 2212, "timestamp_epoch": "1582247272.378434000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-9b53de9b87dee93a5d48f96c", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 4404, "timestamp_epoch": "1582247392.380093000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.174", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.8", "dst_port": 49712, "event_id": "evt-9d052d0a112e8e56afee48ff", "src_port": 445, "tcp_stream": 41, "udp_stream": null, "frame_number": 4515, "timestamp_epoch": "1582247512.396403000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-5526f43c95b0139670914629", "src_port": 49712, "tcp_stream": 41, "udp_stream": null, "frame_number": 5510, "timestamp_epoch": "1582247551.181106000" }, { "kind": "unclassified_tcp", "dst_ip": "172.17.8.8", "fields": { "tcp.payload": "00" }, "src_ip": "172.17.8.174", "dst_port": 445, "event_id": "evt-ee0c6f7c6a719d091fc3c475", "src_port": 49712, "tcp_stream": 41, "udp_stream": null, "frame_number": 5515, "timestamp_epoch": "1582247581.196601000" } ], "directory_service": [ { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-57aadab873c0df3f2a6c020a", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 22, "timestamp_epoch": "1582246431.266973000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-145a7e9dd58cd0906cc6eb43", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 24, "timestamp_epoch": "1582246431.267356000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-36305eb5b09b0a97b19d7ef3", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 80, "timestamp_epoch": "1582246432.382616000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ef1a468e01a70dad9257186a", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 82, "timestamp_epoch": "1582246432.382998000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ebf591324cdd41a8326756f1", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 177, "timestamp_epoch": "1582246432.414003000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0303f5f8bf47674566a57bf6", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 182, "timestamp_epoch": "1582246432.414326000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-917b5aa27ff9907e467f2701", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 188, "timestamp_epoch": "1582246432.414895000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-360cd4d9d1cd3dc7ebbd4cf8", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 191, "timestamp_epoch": "1582246432.415230000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2433fc53ec96601dddc6c6ae", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 199, "timestamp_epoch": "1582246432.416348000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3e8714fa337aebc4999a38a3", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 201, "timestamp_epoch": "1582246432.416696000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0e864458c4ac221f37f01332", "src_port": null, "tcp_stream": 0, "udp_stream": null, "frame_number": 202, "timestamp_epoch": "1582246432.417435000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1eb53f25a470b574fe84dec6", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 206, "timestamp_epoch": "1582246432.418293000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-735d59eb8f7b3982b6d888ee", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 208, "timestamp_epoch": "1582246432.418850000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-509e621004748a99526b948f", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 231, "timestamp_epoch": "1582246432.463703000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f11031bfc4385283f5a82d67", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 232, "timestamp_epoch": "1582246432.463888000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f030dabbed34ce16725152ec", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 233, "timestamp_epoch": "1582246432.464068000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-65686b1ab00e969a1454b693", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 234, "timestamp_epoch": "1582246432.464298000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8cac5656106596ec9103b888", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 235, "timestamp_epoch": "1582246432.464408000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f574a1f9b5c6cd25eb64394a", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 236, "timestamp_epoch": "1582246432.464501000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1c8c64885c1b1175771744d0", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 245, "timestamp_epoch": "1582246432.466513000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-415e92299b9c99db9d2ca949", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 246, "timestamp_epoch": "1582246432.466656000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "30" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-26af74fc46b6186831d347bc", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 247, "timestamp_epoch": "1582246432.467129000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "30" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6ac6f69f33d984d2be0d0046", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 248, "timestamp_epoch": "1582246432.467302000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a35d825159cc1b6c963ce747", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 249, "timestamp_epoch": "1582246432.468189000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0241c696cf4f25673a970d8a", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 250, "timestamp_epoch": "1582246432.468292000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d0f89956d9bc2d1d53f80bf0", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 262, "timestamp_epoch": "1582246432.536873000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-99be823c01258481aa6d7f24", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 264, "timestamp_epoch": "1582246432.537130000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6d52423b8dc0b9c3e6156579", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 274, "timestamp_epoch": "1582246432.651703000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-40f83f9c0799d6c1ac5d4565", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 277, "timestamp_epoch": "1582246432.652025000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-311cd834b014867112d3a153", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 290, "timestamp_epoch": "1582246432.655808000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a351d2aa4a76df2e4b7aee49", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 291, "timestamp_epoch": "1582246432.655968000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7581d9f46ed669a8b544fcfe", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 292, "timestamp_epoch": "1582246432.656165000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0e9e8bbae8e613617ecb3eae", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 293, "timestamp_epoch": "1582246432.656387000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-03e9a517b73dfb435387c1fa", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 294, "timestamp_epoch": "1582246432.656727000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ef1e23d5b180f642f17ff2e9", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 295, "timestamp_epoch": "1582246432.656896000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-822543524b40e15562137875", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 296, "timestamp_epoch": "1582246432.657786000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f79d23b56b73e35d13988e2a", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 297, "timestamp_epoch": "1582246432.657880000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-32cfbfe8f8216f4756fb7a01", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 307, "timestamp_epoch": "1582246432.773832000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-e704f4880f58467158b8b1fb", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 310, "timestamp_epoch": "1582246432.774233000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4bf6b1eceee2d79b4ab8d791", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 316, "timestamp_epoch": "1582246432.778682000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-57a56074e7b006c884421134", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 319, "timestamp_epoch": "1582246432.779134000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-cfb22ee98a2f1b9f546ad097", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 320, "timestamp_epoch": "1582246432.779366000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": {}, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0adef95730e85a9da9b3e490", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 321, "timestamp_epoch": "1582246432.779569000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": {}, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-54b872d3c06f402d01441e29", "src_port": null, "tcp_stream": 4, "udp_stream": null, "frame_number": 322, "timestamp_epoch": "1582246432.779786000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-92d66ee7ff7ace50c130a6f8", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 329, "timestamp_epoch": "1582246432.987902000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ce13c84f07accb50ac64395d", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 331, "timestamp_epoch": "1582246432.988339000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f665a9e9582484b7c94821da", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 334, "timestamp_epoch": "1582246432.989576000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-32a8080d867cafbe28f0db15", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 336, "timestamp_epoch": "1582246432.990383000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2177a5d10d60fc016928900d", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 349, "timestamp_epoch": "1582246433.010257000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6605f51b5271cd5a784c5aeb", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 350, "timestamp_epoch": "1582246433.010584000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-91c7198944ce25fc7413ba54", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 355, "timestamp_epoch": "1582246433.013313000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9142768121f9474101a7d0d4", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 357, "timestamp_epoch": "1582246433.013978000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-37fbb0c80f2d6116f17bf657", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 358, "timestamp_epoch": "1582246433.014431000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8b55b06d15c4c9d5bb8a91c8", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 359, "timestamp_epoch": "1582246433.014608000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8645f6e7a97c4a22109296be", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 360, "timestamp_epoch": "1582246433.014802000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-250f3c7268403c2c494b7611", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 361, "timestamp_epoch": "1582246433.014965000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-981302e0dfbdcbe8697122ba", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 362, "timestamp_epoch": "1582246433.015423000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-59cd914048a9fa0d2ba2756f", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 363, "timestamp_epoch": "1582246433.015723000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-86900b85a2ceb9ebc93fde47", "src_port": null, "tcp_stream": 22, "udp_stream": null, "frame_number": 506, "timestamp_epoch": "1582246433.213526000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2f9e359417f31bb9bcf84ebc", "src_port": null, "tcp_stream": 20, "udp_stream": null, "frame_number": 510, "timestamp_epoch": "1582246433.234074000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-eba6ded58a71b99ed502fc01", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 536, "timestamp_epoch": "1582246434.444263000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1e56a805f5f31dba45a0327c", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 537, "timestamp_epoch": "1582246434.444515000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a98f482f05665eb608164482", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 538, "timestamp_epoch": "1582246434.444948000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-573dfe2d1b944ea5b9ec744b", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 539, "timestamp_epoch": "1582246434.445323000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b1f635849a088da541680cb3", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 540, "timestamp_epoch": "1582246434.445565000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-707b174bf5907b4c6f8c7120", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 541, "timestamp_epoch": "1582246434.445734000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-16350515d717fb00e3f6630e", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 544, "timestamp_epoch": "1582246434.447093000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9d13a8fb3f5fe508a8ee1daa", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 545, "timestamp_epoch": "1582246434.447310000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1327546ce44fb24854b21428", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 546, "timestamp_epoch": "1582246434.447551000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8943e3df6295d67396977d26", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 547, "timestamp_epoch": "1582246434.447843000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9a9d31441bb6bf76af56fa7e", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 548, "timestamp_epoch": "1582246434.448100000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-30531d5dfedc8b63552dc090", "src_port": null, "tcp_stream": 26, "udp_stream": null, "frame_number": 549, "timestamp_epoch": "1582246434.448275000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3f9bc7295b6e9a16adc72470", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 553, "timestamp_epoch": "1582246434.450613000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7294b7a08e73e3e894e4872e", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 555, "timestamp_epoch": "1582246434.450943000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-af00aede281e09163e16ab40", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 558, "timestamp_epoch": "1582246434.451789000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b6c059bb28c10244aed00610", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 560, "timestamp_epoch": "1582246434.452516000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1000a0a808e31a6203826734", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 561, "timestamp_epoch": "1582246434.452920000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0b87ad3ff215a16708b2b63d", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 562, "timestamp_epoch": "1582246434.453146000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-41d85ecb1900045b99ed61d7", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 563, "timestamp_epoch": "1582246434.453435000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6c05a00e8cfe702820605518", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 564, "timestamp_epoch": "1582246434.453641000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b6bcded1b801536ae58af90e", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 565, "timestamp_epoch": "1582246434.453907000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c02ad15fa9016f22f158ec81", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 566, "timestamp_epoch": "1582246434.454101000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1ad28f2977878bf6d38a4c2e", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 571, "timestamp_epoch": "1582246434.456877000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b51b4c55bfba160ca534ff2c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 573, "timestamp_epoch": "1582246434.457650000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b03f673ee144e79ab1de89d9", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 574, "timestamp_epoch": "1582246434.458059000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-40b6a25243775ab9c3644a0c", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 577, "timestamp_epoch": "1582246434.458348000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c0ad8b445ac3fc6441423fc1", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 579, "timestamp_epoch": "1582246434.458729000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f5ccdb41f16d62948363da0b", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 580, "timestamp_epoch": "1582246434.458952000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3ce758eb1c7c029d151f92e9", "src_port": null, "tcp_stream": 28, "udp_stream": null, "frame_number": 581, "timestamp_epoch": "1582246434.459250000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b851312fad0dc86d55dc6c89", "src_port": null, "tcp_stream": 27, "udp_stream": null, "frame_number": 584, "timestamp_epoch": "1582246434.459577000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0d31fccad2f53ee81617ae12", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 622, "timestamp_epoch": "1582246441.616529000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-16a8a9292788ebf5e4e108ab", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 624, "timestamp_epoch": "1582246441.616977000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2914f740df869b607e0fe415", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 627, "timestamp_epoch": "1582246441.618255000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a19dd52cc287d70a77705ebe", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 629, "timestamp_epoch": "1582246441.619162000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5f5614434ff0dbe9ff3950f9", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 630, "timestamp_epoch": "1582246441.621124000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c4636c4d5a8c4778113d22c9", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 631, "timestamp_epoch": "1582246441.621377000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8651a85449d9660bc190cf73", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 632, "timestamp_epoch": "1582246441.621822000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6bd92fce4cef916dbb7bda94", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 633, "timestamp_epoch": "1582246441.622030000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=NTDS Settings,CN=ONE-HOT-MESS-DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d2a77d18aa009b32bc49e6f1", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 634, "timestamp_epoch": "1582246441.622298000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d4d048e758802052b4317f30", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 635, "timestamp_epoch": "1582246441.622529000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "3", "ldap.baseObject": "CN=Public Key Services,CN=Services,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-645af9ec1306b8a8d0336141", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 636, "timestamp_epoch": "1582246441.622803000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1f91082d7d752633d11673eb", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 637, "timestamp_epoch": "1582246441.623038000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-88287f15ef26ab816d9d9bcc", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 638, "timestamp_epoch": "1582246441.623419000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-524527e20c07ac161a080548", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 639, "timestamp_epoch": "1582246441.623660000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e487f66a4aeaba075d4fa638", "src_port": null, "tcp_stream": 30, "udp_stream": null, "frame_number": 670, "timestamp_epoch": "1582246441.632433000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-aabf5564c4de51c225c9361e", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 765, "timestamp_epoch": "1582246452.174091000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b8b73975317d5e7cc9ff8c53", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 766, "timestamp_epoch": "1582246452.174305000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9ebefb0506001f6d0417a43c", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 767, "timestamp_epoch": "1582246452.174763000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5bd53952515c7824c285e8a5", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 768, "timestamp_epoch": "1582246452.175070000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-22635f225f3aa51aeb229325", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 769, "timestamp_epoch": "1582246452.175907000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-04cc398c766ca38f52455d1e", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 770, "timestamp_epoch": "1582246452.176141000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c320bd0fd297fa40bfc5df56", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 771, "timestamp_epoch": "1582246452.176342000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-875dcf4fcc6ee1eb1b86c2a7", "src_port": null, "tcp_stream": 15, "udp_stream": null, "frame_number": 772, "timestamp_epoch": "1582246452.176489000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "64" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ac2639a57cd2a208e3459f0b", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 810, "timestamp_epoch": "1582246452.244930000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "64" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ba226d80d1c6d67c4b16c0c5", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 811, "timestamp_epoch": "1582246452.245395000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "6" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-954a61c1cc3389021c8abbf5", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 812, "timestamp_epoch": "1582246452.246938000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "6" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2baeeb4943a9e90775f9afe2", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 813, "timestamp_epoch": "1582246452.247258000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "5" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-935242ab6d83e70069128cbf", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 814, "timestamp_epoch": "1582246452.252105000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5a9b2ab2d584ddf30ec3aacd", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 815, "timestamp_epoch": "1582246452.252439000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "7" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-693fa8c9023f37addcacf557", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 816, "timestamp_epoch": "1582246452.253406000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "7" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-45e53899367b74a95081db82", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 817, "timestamp_epoch": "1582246452.253801000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "7" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-abcae496366b310f1f8fbdd6", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 818, "timestamp_epoch": "1582246452.254816000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "7" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ea77cf4089143a3d43660c88", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 819, "timestamp_epoch": "1582246452.255215000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "17" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-710bc41c2086474aa0aea84b", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 820, "timestamp_epoch": "1582246452.255918000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "17" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c864d9861819b5b9a0ae9f13", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 821, "timestamp_epoch": "1582246452.256417000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "34" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-da3f4eb57e2dee476d557346", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 822, "timestamp_epoch": "1582246452.257049000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "34" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4a468dbed525fd7088fdd2ab", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 823, "timestamp_epoch": "1582246452.257538000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "36" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3c7391ad19509f0a3f745e9b", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 824, "timestamp_epoch": "1582246452.263816000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "36", "samr.samr_UserInfo21.full_name": "Gabriella Ventura", "samr.samr_UserInfo21.account_name": "gabriella.ventura" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2786c3931857fa3f5060ee8b", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 825, "timestamp_epoch": "1582246452.264291000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3e7d31ebb53d7ddbeab2cb59", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 826, "timestamp_epoch": "1582246452.265047000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "3" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-f99855044a16bb74ae110a2e", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 827, "timestamp_epoch": "1582246452.265455000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "39" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-18a643f7518fdefc270f0b6a", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 828, "timestamp_epoch": "1582246452.267353000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "39" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-56af7f773bc9f3b545242901", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 829, "timestamp_epoch": "1582246452.267813000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "16" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-497d73c0d01d9d743403c61d", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 830, "timestamp_epoch": "1582246452.269551000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "16" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9be92ac75688dfb7a2ca0e27", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 831, "timestamp_epoch": "1582246452.269872000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0e2d17901b1a8059385181d2", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 832, "timestamp_epoch": "1582246452.270287000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0364290c512307e5508ab9cf", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 833, "timestamp_epoch": "1582246452.270601000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c1a981f10a3c5fa35b87e82a", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 834, "timestamp_epoch": "1582246452.271503000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ad8430aaa23d64bcec53045c", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 835, "timestamp_epoch": "1582246452.271788000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f0a80b35a075df89d520eb09", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 836, "timestamp_epoch": "1582246452.272331000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-c7f831722a942adf129b66f4", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 837, "timestamp_epoch": "1582246452.272637000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-570d82304ac9c46ecf29e12d", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 841, "timestamp_epoch": "1582246452.274434000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "samr.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-05810b32824c0c6edbcfbdb9", "src_port": null, "tcp_stream": 39, "udp_stream": null, "frame_number": 842, "timestamp_epoch": "1582246452.274812000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-44aa61b89c5ce74b75a99bbc", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 894, "timestamp_epoch": "1582246452.515696000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-26b681f8633625a8f78c350f", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 896, "timestamp_epoch": "1582246452.516651000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "1", "ldap.baseObject": "DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d248125b77f9bae8c24e8cf8", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 897, "timestamp_epoch": "1582246452.523628000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,19,19,19,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-554d938cea171d57b89a6753", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 898, "timestamp_epoch": "1582246452.524221000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7359656379fa68187f21a064", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 903, "timestamp_epoch": "1582246452.531483000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b975bc82759f073739d907d0", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 905, "timestamp_epoch": "1582246452.532464000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ea6dc12bf199da208b1b022b", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 906, "timestamp_epoch": "1582246452.533092000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1404c8392a307e3832d4c126", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 907, "timestamp_epoch": "1582246452.533292000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-e94f64762510d2388351ec83", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 908, "timestamp_epoch": "1582246452.533823000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-526e1eb7dbe137478291399d", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 909, "timestamp_epoch": "1582246452.534025000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "0", "ldap.baseObject": "cn=policies,cn=system,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-17efe2aa0b1edfe7d4d89b7b", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 910, "timestamp_epoch": "1582246452.535098000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-edcc730654d7e99edf208819", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 911, "timestamp_epoch": "1582246452.535450000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d5975fc7b6b1cf026df63eb3", "src_port": null, "tcp_stream": 45, "udp_stream": null, "frame_number": 915, "timestamp_epoch": "1582246452.860304000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-27b58bc8e1a734968d2de71f", "src_port": null, "tcp_stream": 44, "udp_stream": null, "frame_number": 917, "timestamp_epoch": "1582246452.866967000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-466f9c9d8b2585f8cf317e79", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1124, "timestamp_epoch": "1582246463.999088000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1084860e242da3fcaec84148", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1125, "timestamp_epoch": "1582246463.999345000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c4a348eb578548d919e851d4", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1126, "timestamp_epoch": "1582246463.999570000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-cda2d74ab003e334bc44bd12", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1127, "timestamp_epoch": "1582246463.999900000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5cc20e0e4711eb141cbb28ee", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1128, "timestamp_epoch": "1582246464.000094000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-7c36de63fd387b5b8059fee5", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1129, "timestamp_epoch": "1582246464.000256000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-79228200f38989698d11ebd4", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1132, "timestamp_epoch": "1582246464.002043000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-e4d1fceb286bdd6194968141", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1133, "timestamp_epoch": "1582246464.002238000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1ac887b3f2cf82e45527aa9a", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1134, "timestamp_epoch": "1582246464.002437000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-e87d63b87e0714c9410ace94", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1135, "timestamp_epoch": "1582246464.002797000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-9398f8678f01e6a53354f55d", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1136, "timestamp_epoch": "1582246464.003071000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d48040dbac252253ccc8c8bf", "src_port": null, "tcp_stream": 53, "udp_stream": null, "frame_number": 1137, "timestamp_epoch": "1582246464.003245000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-8ba467aa517c6c7e8e0baccb", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1141, "timestamp_epoch": "1582246464.006926000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-09464099e7e6b04dac6df702", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1143, "timestamp_epoch": "1582246464.007395000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4393f535b7c04193b4c71c78", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1146, "timestamp_epoch": "1582246464.008567000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-4b6cb5ea7fa8e652cec53c78", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1148, "timestamp_epoch": "1582246464.009550000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-153acb214eff8847c3d92e3c", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1149, "timestamp_epoch": "1582246464.010526000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-24080acc01b5836db466360c", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1150, "timestamp_epoch": "1582246464.010829000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-16c65f9091b57754dfb1157e", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1151, "timestamp_epoch": "1582246464.011094000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-103af03f9652e3b127eeeb09", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1152, "timestamp_epoch": "1582246464.011315000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ba1ec036740713ec2374910d", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1153, "timestamp_epoch": "1582246464.011550000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-43fe66686ac3aa687c626ede", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1154, "timestamp_epoch": "1582246464.011774000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-35d3a7ab7d19a28ae0fadafa", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1159, "timestamp_epoch": "1582246464.015437000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-79cdb0dd2b0600f74efe92e2", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1161, "timestamp_epoch": "1582246464.016242000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6e683847f46d97f88409e4c6", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1162, "timestamp_epoch": "1582246464.016706000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2693325ee5285a7ef04f48d1", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1165, "timestamp_epoch": "1582246464.017000000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-6f00835bf387c1d8c0006960", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1167, "timestamp_epoch": "1582246464.017330000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5496a21af62dd8072c9dd267", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1168, "timestamp_epoch": "1582246464.017584000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a6396cdf52469789e4b96452", "src_port": null, "tcp_stream": 55, "udp_stream": null, "frame_number": 1169, "timestamp_epoch": "1582246464.017830000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-41013d51207bf4c20b8f901b", "src_port": null, "tcp_stream": 54, "udp_stream": null, "frame_number": 1172, "timestamp_epoch": "1582246464.018230000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-485923b09f0539dc0da562c3", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1193, "timestamp_epoch": "1582246464.652699000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-95393e435af87704c21c2a9f", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1195, "timestamp_epoch": "1582246464.653373000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1c0a1c5159cfb68112856f8c", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1198, "timestamp_epoch": "1582246464.658240000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-05d05c5d5d2522d40c93f228", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1200, "timestamp_epoch": "1582246464.659378000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-3a10d3584193ed0742fa8851", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1201, "timestamp_epoch": "1582246464.668738000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-1cc5c7177df4b38ac3adf183", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1202, "timestamp_epoch": "1582246464.669484000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-84de4fcd242a3024a7ccc255", "src_port": null, "tcp_stream": 57, "udp_stream": null, "frame_number": 1203, "timestamp_epoch": "1582246464.675229000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5dffcd98688b8b096c7f8be5", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1317, "timestamp_epoch": "1582246503.645704000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-cec9526088e39ae739e379bb", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1319, "timestamp_epoch": "1582246503.646297000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5f68b15aac9c2be59ee0c861", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1322, "timestamp_epoch": "1582246503.648251000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-268e551764bcd73adb8114ea", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1324, "timestamp_epoch": "1582246503.649225000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "0", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-ea16067cba3caeaccd146458", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1325, "timestamp_epoch": "1582246503.651138000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-9192a30d64371b760853709e", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1326, "timestamp_epoch": "1582246503.651824000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c1480d695a176237c6906e80", "src_port": null, "tcp_stream": 59, "udp_stream": null, "frame_number": 1327, "timestamp_epoch": "1582246503.652852000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-209c460fb876afaa8f1f9cc6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1597, "timestamp_epoch": "1582246513.087747000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b164ba616d457b197da7bd77", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1598, "timestamp_epoch": "1582246513.088266000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-71bf299701c9fb4a502128ca", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1599, "timestamp_epoch": "1582246513.090525000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8a995b6ba45e4a10c6ac185d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1600, "timestamp_epoch": "1582246513.091676000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-2f5ea69bb7a7b667e3ed482d", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1601, "timestamp_epoch": "1582246513.092129000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ea8413f562974bcb37a96fd1", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1602, "timestamp_epoch": "1582246513.092369000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-c8a9e413fd35b8737afa1337", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1605, "timestamp_epoch": "1582246513.094323000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-3d24c3c3d2d850edae1d73b5", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1606, "timestamp_epoch": "1582246513.094569000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-210b8440104565171dad0ec6", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1607, "timestamp_epoch": "1582246513.094834000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-57a41e0226176e87b2cbfd70", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1608, "timestamp_epoch": "1582246513.095269000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b1262dec10e4c1525d85fabc", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1609, "timestamp_epoch": "1582246513.095516000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6315d354293a074dfe658989", "src_port": null, "tcp_stream": 63, "udp_stream": null, "frame_number": 1610, "timestamp_epoch": "1582246513.095690000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-948052138955ae334a6e5d77", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1614, "timestamp_epoch": "1582246513.097903000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-2a161d2e2cbe5e36aa9bc128", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1616, "timestamp_epoch": "1582246513.098286000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-4d9702b6f8c9bd348b326bbf", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1619, "timestamp_epoch": "1582246513.099371000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-755fbd3c9a0b2514f5e36022", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1621, "timestamp_epoch": "1582246513.100279000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-75fc31b191d4328d7eb92380", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1622, "timestamp_epoch": "1582246513.101999000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-70d73dc9131b0c7c07334ef7", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1623, "timestamp_epoch": "1582246513.103317000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b52e5ebd61ae07ded3f51d5a", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1624, "timestamp_epoch": "1582246513.104145000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6bb73df6833221e17835895b", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1625, "timestamp_epoch": "1582246513.104523000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-183c165eb65b908f0e3947e9", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1626, "timestamp_epoch": "1582246513.104831000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-5ee736671725bdd30d76e9c2", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1627, "timestamp_epoch": "1582246513.105085000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-73c8592c6bcd6719bf238c78", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1632, "timestamp_epoch": "1582246513.108555000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a31508f92af0273173d52451", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1634, "timestamp_epoch": "1582246513.110275000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-08aa35e2c35944d34c53fc8b", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1635, "timestamp_epoch": "1582246513.111313000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-87094e55ec9876f449363737", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1638, "timestamp_epoch": "1582246513.112196000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-037eccf179698ed8c98dbdc4", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1640, "timestamp_epoch": "1582246513.114338000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-b798b30b505efad94f0f2086", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1641, "timestamp_epoch": "1582246513.115889000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-aef1b5b823332a313cafd6f2", "src_port": null, "tcp_stream": 65, "udp_stream": null, "frame_number": 1642, "timestamp_epoch": "1582246513.116444000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-7a7445ebe908e888ec69d431", "src_port": null, "tcp_stream": 64, "udp_stream": null, "frame_number": 1646, "timestamp_epoch": "1582246513.117058000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-5e25fe582739217fd4f1e9cd", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1818, "timestamp_epoch": "1582246733.537967000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a8686b9ec710d9f47cda537b", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1819, "timestamp_epoch": "1582246733.538215000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-d4f539e324ae47e662171d86", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1820, "timestamp_epoch": "1582246733.540844000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-897fbee44df9f2e3d3f4e117", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1821, "timestamp_epoch": "1582246733.541165000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-1e0991d6439f4db424a272b8", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1822, "timestamp_epoch": "1582246733.543981000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-39c32ee9f91dcc80206406fe", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1823, "timestamp_epoch": "1582246733.544149000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a85d3c372bea71088ff26d32", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1826, "timestamp_epoch": "1582246733.545442000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "0" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-8a94eaed6f6bafe5ea031124", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1827, "timestamp_epoch": "1582246733.545613000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-50d87b387d5d087d5480a8da", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1828, "timestamp_epoch": "1582246733.545828000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "12" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-ac3c2bc6e534335c48d8da46", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1829, "timestamp_epoch": "1582246733.546098000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-663907ee7c683193b8174e10", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1830, "timestamp_epoch": "1582246733.546312000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "drsuapi.opnum": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-6a0548087b622c1b1dc4ff48", "src_port": null, "tcp_stream": 70, "udp_stream": null, "frame_number": 1831, "timestamp_epoch": "1582246733.546473000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-20d7d0b2789865ff48beccf6", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1835, "timestamp_epoch": "1582246733.548318000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-d7a7d6c0c503107849f0e71f", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1837, "timestamp_epoch": "1582246733.548600000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-43e18d19a919cde0e4b00ec4", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1840, "timestamp_epoch": "1582246733.549398000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-33d68562014107321dbc9df1", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1842, "timestamp_epoch": "1582246733.550086000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-a9eb46bb05c767595c716193", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1843, "timestamp_epoch": "1582246733.550467000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-596a3f0abddd2e921be9609b", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1844, "timestamp_epoch": "1582246733.550704000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-781ec3c6af7a7ef960e42bf9", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1845, "timestamp_epoch": "1582246733.550964000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-e6168cd9d79c05fc2c1f7e19", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1846, "timestamp_epoch": "1582246733.551138000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=DESKTOP-TZMKHKC,CN=Computers,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-dd63d76c7d994447303b6090", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1847, "timestamp_epoch": "1582246733.551361000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a355a00748d0dbebc7e714d2", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1848, "timestamp_epoch": "1582246733.551553000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "0" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-f91cf8670b0834ab4859c075", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1853, "timestamp_epoch": "1582246733.554288000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "1" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-de4a936efad02c3c547474c6", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1855, "timestamp_epoch": "1582246733.554929000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-43b258c30ca0a1cbb6232163", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1856, "timestamp_epoch": "1582246733.555328000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "4,5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-0e3248c65aaa2fa30e62ff82", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1859, "timestamp_epoch": "1582246733.555636000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.filter": "7", "ldap.baseObject": "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=services,CN=Configuration,DC=one-hot-mess,DC=com", "ldap.protocolOp": "3" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-0e80668cc62830b14d20bbbc", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1861, "timestamp_epoch": "1582246733.555958000" }, { "kind": "directory_service", "dst_ip": "172.17.8.174", "fields": { "ldap.protocolOp": "5" }, "src_ip": "172.17.8.8", "dst_port": null, "event_id": "evt-a98d429134a988535babc40d", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1862, "timestamp_epoch": "1582246733.556171000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-b8ac6e1437eefc87a226582c", "src_port": null, "tcp_stream": 72, "udp_stream": null, "frame_number": 1863, "timestamp_epoch": "1582246733.556438000" }, { "kind": "directory_service", "dst_ip": "172.17.8.8", "fields": { "ldap.protocolOp": "2" }, "src_ip": "172.17.8.174", "dst_port": null, "event_id": "evt-db2b37d344f95f6b349267ec", "src_port": null, "tcp_stream": 71, "udp_stream": null, "frame_number": 1867, "timestamp_epoch": "1582246733.556787000" } ] }, "capture": { "format": "pcap-le-microsecond", "packet_count": 9698, "interface_ids": [], "source_sha256": "8b984eca8fb96799a9ad7ec5ee766937e640dc1afcad77101e5aeb0ba6be137d", "captured_bytes": 7487150, "protocol_counts": { "ip": 9698, "cms": 15, "dns": 129, "eth": 9698, "ntp": 4, "smb": 7, "tcp": 9461, "tls": 724, "udp": 227, "data": 45, "dhcp": 2, "http": 56, "igmp": 20, "ldap": 165, "mdns": 4, "nbns": 51, "nbss": 249, "ocsp": 51, "smb2": 245, "cldap": 32, "llmnr": 2, "nbdgm": 3, "dcerpc": 196, "pkcs-1": 8, "spnego": 86, "x509ce": 833, "browser": 3, "gss-api": 138, "ntlmssp": 5, "x509sat": 1057, "kerberos": 46, "ethertype": 9698, "spnego-krb5": 335, "pkix1explicit": 79, "pkix1implicit": 92 }, "duration_seconds": 1221.525013, "last_packet_epoch": "1582247652.153841", "source_size_bytes": 7642342, "first_packet_epoch": "1582246430.628828", "encapsulation_types": [ 1 ] }, "summary": "Decoded 9698 packets across 40 IP endpoints and 223 transport flows. Observed 129 DNS events, 29 HTTP requests, 50 TLS ClientHello events, and 10 recovered file/message object(s). Deterministic rules produced 6 finding(s): 0 high, 0 medium, and 6 low. Findings are evidence-bound candidates and require analyst review; encrypted payload contents remain unavailable.", "coverage": { "warnings": [], "limitations": [ "Encrypted application contents are not decrypted", "Protocol decoding and heuristic findings do not establish malware family or attribution", "No endpoint execution, persistence, or credential-theft proof without corresponding evidence" ], "event_limits": { "dns": { "returned": 129, "truncated": false }, "dhcp": { "returned": 2, "truncated": false }, "smtp": { "returned": 0, "truncated": false }, "identity": { "returned": 409, "truncated": false }, "http_request": { "returned": 29, "truncated": false }, "http_response": { "returned": 27, "truncated": false }, "tls_client_hello": { "returned": 50, "truncated": false }, "unclassified_tcp": { "returned": 20, "truncated": false }, "directory_service": { "returned": 261, "truncated": false } }, "http_objects": { "complete": true, "selection": "content-classified first, then size descending, SHA256 tie-break; deduplicated by full hash; overflow retains a compact hash index", "hashed_bytes": 2812152, "export_status": "completed", "unique_hashes": 10, "hashed_objects": 21, "compact_objects": 0, "detailed_objects": 10, "exported_objects": 21, "unhashed_objects": 0, "compact_hash_index": [], "omitted_unique_hashes": 0, "returned_unique_hashes": 10 }, "name_resolution": false, "supplemental_objects": { "scope": "bounded IMF, inert embedded base64 and complete contiguous HTTP response recovery", "returned": 0 }, "complete_within_profile": true, "encrypted_payload_visibility": "metadata-only" }, "findings": [ { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.174", "protocol": "drsuapi", "destination": "172.17.8.8", "event_count": 38, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 15, "frame_number": 231, "display_filter": "frame.number == 231", "timestamp_epoch": "1582246432.463703000" }, { "tcp_stream": 15, "frame_number": 233, "display_filter": "frame.number == 233", "timestamp_epoch": "1582246432.464068000" }, { "tcp_stream": 15, "frame_number": 235, "display_filter": "frame.number == 235", "timestamp_epoch": "1582246432.464408000" }, { "tcp_stream": 15, "frame_number": 245, "display_filter": "frame.number == 245", "timestamp_epoch": "1582246432.466513000" }, { "tcp_stream": 15, "frame_number": 247, "display_filter": "frame.number == 247", "timestamp_epoch": "1582246432.467129000" }, { "tcp_stream": 15, "frame_number": 249, "display_filter": "frame.number == 249", "timestamp_epoch": "1582246432.468189000" }, { "tcp_stream": 15, "frame_number": 290, "display_filter": "frame.number == 290", "timestamp_epoch": "1582246432.655808000" }, { "tcp_stream": 15, "frame_number": 292, "display_filter": "frame.number == 292", "timestamp_epoch": "1582246432.656165000" }, { "tcp_stream": 15, "frame_number": 294, "display_filter": "frame.number == 294", "timestamp_epoch": "1582246432.656727000" }, { "tcp_stream": 15, "frame_number": 296, "display_filter": "frame.number == 296", "timestamp_epoch": "1582246432.657786000" }, { "tcp_stream": 26, "frame_number": 536, "display_filter": "frame.number == 536", "timestamp_epoch": "1582246434.444263000" }, { "tcp_stream": 26, "frame_number": 538, "display_filter": "frame.number == 538", "timestamp_epoch": "1582246434.444948000" }, { "tcp_stream": 26, "frame_number": 540, "display_filter": "frame.number == 540", "timestamp_epoch": "1582246434.445565000" }, { "tcp_stream": 26, "frame_number": 544, "display_filter": "frame.number == 544", "timestamp_epoch": "1582246434.447093000" }, { "tcp_stream": 26, "frame_number": 546, "display_filter": "frame.number == 546", "timestamp_epoch": "1582246434.447551000" }, { "tcp_stream": 26, "frame_number": 548, "display_filter": "frame.number == 548", "timestamp_epoch": "1582246434.448100000" }, { "tcp_stream": 15, "frame_number": 765, "display_filter": "frame.number == 765", "timestamp_epoch": "1582246452.174091000" }, { "tcp_stream": 15, "frame_number": 767, "display_filter": "frame.number == 767", "timestamp_epoch": "1582246452.174763000" }, { "tcp_stream": 15, "frame_number": 769, "display_filter": "frame.number == 769", "timestamp_epoch": "1582246452.175907000" }, { "tcp_stream": 15, "frame_number": 771, "display_filter": "frame.number == 771", "timestamp_epoch": "1582246452.176342000" }, { "tcp_stream": 53, "frame_number": 1124, "display_filter": "frame.number == 1124", "timestamp_epoch": "1582246463.999088000" }, { "tcp_stream": 53, "frame_number": 1126, "display_filter": "frame.number == 1126", "timestamp_epoch": "1582246463.999570000" }, { "tcp_stream": 53, "frame_number": 1128, "display_filter": "frame.number == 1128", "timestamp_epoch": "1582246464.000094000" }, { "tcp_stream": 53, "frame_number": 1132, "display_filter": "frame.number == 1132", "timestamp_epoch": "1582246464.002043000" }, { "tcp_stream": 53, "frame_number": 1134, "display_filter": "frame.number == 1134", "timestamp_epoch": "1582246464.002437000" }, { "tcp_stream": 53, "frame_number": 1136, "display_filter": "frame.number == 1136", "timestamp_epoch": "1582246464.003071000" }, { "tcp_stream": 63, "frame_number": 1597, "display_filter": "frame.number == 1597", "timestamp_epoch": "1582246513.087747000" }, { "tcp_stream": 63, "frame_number": 1599, "display_filter": "frame.number == 1599", "timestamp_epoch": "1582246513.090525000" }, { "tcp_stream": 63, "frame_number": 1601, "display_filter": "frame.number == 1601", "timestamp_epoch": "1582246513.092129000" }, { "tcp_stream": 63, "frame_number": 1605, "display_filter": "frame.number == 1605", "timestamp_epoch": "1582246513.094323000" }, { "tcp_stream": 63, "frame_number": 1607, "display_filter": "frame.number == 1607", "timestamp_epoch": "1582246513.094834000" }, { "tcp_stream": 63, "frame_number": 1609, "display_filter": "frame.number == 1609", "timestamp_epoch": "1582246513.095516000" }, { "tcp_stream": 70, "frame_number": 1818, "display_filter": "frame.number == 1818", "timestamp_epoch": "1582246733.537967000" }, { "tcp_stream": 70, "frame_number": 1820, "display_filter": "frame.number == 1820", "timestamp_epoch": "1582246733.540844000" }, { "tcp_stream": 70, "frame_number": 1822, "display_filter": "frame.number == 1822", "timestamp_epoch": "1582246733.543981000" }, { "tcp_stream": 70, "frame_number": 1826, "display_filter": "frame.number == 1826", "timestamp_epoch": "1582246733.545442000" }, { "tcp_stream": 70, "frame_number": 1828, "display_filter": "frame.number == 1828", "timestamp_epoch": "1582246733.545828000" }, { "tcp_stream": 70, "frame_number": 1830, "display_filter": "frame.number == 1830", "timestamp_epoch": "1582246733.546312000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-abcbfba4dcad2a22053513ad", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.174", "protocol": "ldap", "destination": "172.17.8.8", "event_count": 86, "operation_numbers": [ "", "0", "2", "3" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 0, "frame_number": 22, "display_filter": "frame.number == 22", "timestamp_epoch": "1582246431.266973000" }, { "tcp_stream": 4, "frame_number": 80, "display_filter": "frame.number == 80", "timestamp_epoch": "1582246432.382616000" }, { "tcp_stream": 4, "frame_number": 177, "display_filter": "frame.number == 177", "timestamp_epoch": "1582246432.414003000" }, { "tcp_stream": 0, "frame_number": 182, "display_filter": "frame.number == 182", "timestamp_epoch": "1582246432.414326000" }, { "tcp_stream": 4, "frame_number": 199, "display_filter": "frame.number == 199", "timestamp_epoch": "1582246432.416348000" }, { "tcp_stream": 0, "frame_number": 202, "display_filter": "frame.number == 202", "timestamp_epoch": "1582246432.417435000" }, { "tcp_stream": 4, "frame_number": 206, "display_filter": "frame.number == 206", "timestamp_epoch": "1582246432.418293000" }, { "tcp_stream": 4, "frame_number": 262, "display_filter": "frame.number == 262", "timestamp_epoch": "1582246432.536873000" }, { "tcp_stream": 4, "frame_number": 274, "display_filter": "frame.number == 274", "timestamp_epoch": "1582246432.651703000" }, { "tcp_stream": 4, "frame_number": 307, "display_filter": "frame.number == 307", "timestamp_epoch": "1582246432.773832000" }, { "tcp_stream": 4, "frame_number": 316, "display_filter": "frame.number == 316", "timestamp_epoch": "1582246432.778682000" }, { "tcp_stream": 4, "frame_number": 320, "display_filter": "frame.number == 320", "timestamp_epoch": "1582246432.779366000" }, { "tcp_stream": 4, "frame_number": 322, "display_filter": "frame.number == 322", "timestamp_epoch": "1582246432.779786000" }, { "tcp_stream": 20, "frame_number": 329, "display_filter": "frame.number == 329", "timestamp_epoch": "1582246432.987902000" }, { "tcp_stream": 20, "frame_number": 334, "display_filter": "frame.number == 334", "timestamp_epoch": "1582246432.989576000" }, { "tcp_stream": 20, "frame_number": 349, "display_filter": "frame.number == 349", "timestamp_epoch": "1582246433.010257000" }, { "tcp_stream": 22, "frame_number": 355, "display_filter": "frame.number == 355", "timestamp_epoch": "1582246433.013313000" }, { "tcp_stream": 22, "frame_number": 358, "display_filter": "frame.number == 358", "timestamp_epoch": "1582246433.014431000" }, { "tcp_stream": 22, "frame_number": 360, "display_filter": "frame.number == 360", "timestamp_epoch": "1582246433.014802000" }, { "tcp_stream": 20, "frame_number": 362, "display_filter": "frame.number == 362", "timestamp_epoch": "1582246433.015423000" }, { "tcp_stream": 22, "frame_number": 506, "display_filter": "frame.number == 506", "timestamp_epoch": "1582246433.213526000" }, { "tcp_stream": 20, "frame_number": 510, "display_filter": "frame.number == 510", "timestamp_epoch": "1582246433.234074000" }, { "tcp_stream": 27, "frame_number": 553, "display_filter": "frame.number == 553", "timestamp_epoch": "1582246434.450613000" }, { "tcp_stream": 27, "frame_number": 558, "display_filter": "frame.number == 558", "timestamp_epoch": "1582246434.451789000" }, { "tcp_stream": 27, "frame_number": 561, "display_filter": "frame.number == 561", "timestamp_epoch": "1582246434.452920000" }, { "tcp_stream": 27, "frame_number": 563, "display_filter": "frame.number == 563", "timestamp_epoch": "1582246434.453435000" }, { "tcp_stream": 27, "frame_number": 565, "display_filter": "frame.number == 565", "timestamp_epoch": "1582246434.453907000" }, { "tcp_stream": 28, "frame_number": 571, "display_filter": "frame.number == 571", "timestamp_epoch": "1582246434.456877000" }, { "tcp_stream": 28, "frame_number": 574, "display_filter": "frame.number == 574", "timestamp_epoch": "1582246434.458059000" }, { "tcp_stream": 28, "frame_number": 579, "display_filter": "frame.number == 579", "timestamp_epoch": "1582246434.458729000" }, { "tcp_stream": 28, "frame_number": 581, "display_filter": "frame.number == 581", "timestamp_epoch": "1582246434.459250000" }, { "tcp_stream": 27, "frame_number": 584, "display_filter": "frame.number == 584", "timestamp_epoch": "1582246434.459577000" }, { "tcp_stream": 30, "frame_number": 622, "display_filter": "frame.number == 622", "timestamp_epoch": "1582246441.616529000" }, { "tcp_stream": 30, "frame_number": 627, "display_filter": "frame.number == 627", "timestamp_epoch": "1582246441.618255000" }, { "tcp_stream": 30, "frame_number": 630, "display_filter": "frame.number == 630", "timestamp_epoch": "1582246441.621124000" }, { "tcp_stream": 30, "frame_number": 632, "display_filter": "frame.number == 632", "timestamp_epoch": "1582246441.621822000" }, { "tcp_stream": 30, "frame_number": 634, "display_filter": "frame.number == 634", "timestamp_epoch": "1582246441.622298000" }, { "tcp_stream": 30, "frame_number": 636, "display_filter": "frame.number == 636", "timestamp_epoch": "1582246441.622803000" }, { "tcp_stream": 30, "frame_number": 638, "display_filter": "frame.number == 638", "timestamp_epoch": "1582246441.623419000" }, { "tcp_stream": 30, "frame_number": 670, "display_filter": "frame.number == 670", "timestamp_epoch": "1582246441.632433000" }, { "tcp_stream": 44, "frame_number": 894, "display_filter": "frame.number == 894", "timestamp_epoch": "1582246452.515696000" }, { "tcp_stream": 44, "frame_number": 897, "display_filter": "frame.number == 897", "timestamp_epoch": "1582246452.523628000" }, { "tcp_stream": 45, "frame_number": 903, "display_filter": "frame.number == 903", "timestamp_epoch": "1582246452.531483000" }, { "tcp_stream": 45, "frame_number": 906, "display_filter": "frame.number == 906", "timestamp_epoch": "1582246452.533092000" }, { "tcp_stream": 45, "frame_number": 908, "display_filter": "frame.number == 908", "timestamp_epoch": "1582246452.533823000" }, { "tcp_stream": 44, "frame_number": 910, "display_filter": "frame.number == 910", "timestamp_epoch": "1582246452.535098000" }, { "tcp_stream": 45, "frame_number": 915, "display_filter": "frame.number == 915", "timestamp_epoch": "1582246452.860304000" }, { "tcp_stream": 44, "frame_number": 917, "display_filter": "frame.number == 917", "timestamp_epoch": "1582246452.866967000" }, { "tcp_stream": 54, "frame_number": 1141, "display_filter": "frame.number == 1141", "timestamp_epoch": "1582246464.006926000" }, { "tcp_stream": 54, "frame_number": 1146, "display_filter": "frame.number == 1146", "timestamp_epoch": "1582246464.008567000" }, { "tcp_stream": 54, "frame_number": 1149, "display_filter": "frame.number == 1149", "timestamp_epoch": "1582246464.010526000" }, { "tcp_stream": 54, "frame_number": 1151, "display_filter": "frame.number == 1151", "timestamp_epoch": "1582246464.011094000" }, { "tcp_stream": 54, "frame_number": 1153, "display_filter": "frame.number == 1153", "timestamp_epoch": "1582246464.011550000" }, { "tcp_stream": 55, "frame_number": 1159, "display_filter": "frame.number == 1159", "timestamp_epoch": "1582246464.015437000" }, { "tcp_stream": 55, "frame_number": 1162, "display_filter": "frame.number == 1162", "timestamp_epoch": "1582246464.016706000" }, { "tcp_stream": 55, "frame_number": 1167, "display_filter": "frame.number == 1167", "timestamp_epoch": "1582246464.017330000" }, { "tcp_stream": 55, "frame_number": 1169, "display_filter": "frame.number == 1169", "timestamp_epoch": "1582246464.017830000" }, { "tcp_stream": 54, "frame_number": 1172, "display_filter": "frame.number == 1172", "timestamp_epoch": "1582246464.018230000" }, { "tcp_stream": 57, "frame_number": 1193, "display_filter": "frame.number == 1193", "timestamp_epoch": "1582246464.652699000" }, { "tcp_stream": 57, "frame_number": 1198, "display_filter": "frame.number == 1198", "timestamp_epoch": "1582246464.658240000" }, { "tcp_stream": 57, "frame_number": 1201, "display_filter": "frame.number == 1201", "timestamp_epoch": "1582246464.668738000" }, { "tcp_stream": 57, "frame_number": 1203, "display_filter": "frame.number == 1203", "timestamp_epoch": "1582246464.675229000" }, { "tcp_stream": 59, "frame_number": 1317, "display_filter": "frame.number == 1317", "timestamp_epoch": "1582246503.645704000" }, { "tcp_stream": 59, "frame_number": 1322, "display_filter": "frame.number == 1322", "timestamp_epoch": "1582246503.648251000" }, { "tcp_stream": 59, "frame_number": 1325, "display_filter": "frame.number == 1325", "timestamp_epoch": "1582246503.651138000" }, { "tcp_stream": 59, "frame_number": 1327, "display_filter": "frame.number == 1327", "timestamp_epoch": "1582246503.652852000" }, { "tcp_stream": 64, "frame_number": 1614, "display_filter": "frame.number == 1614", "timestamp_epoch": "1582246513.097903000" }, { "tcp_stream": 64, "frame_number": 1619, "display_filter": "frame.number == 1619", "timestamp_epoch": "1582246513.099371000" }, { "tcp_stream": 64, "frame_number": 1622, "display_filter": "frame.number == 1622", "timestamp_epoch": "1582246513.101999000" }, { "tcp_stream": 64, "frame_number": 1624, "display_filter": "frame.number == 1624", "timestamp_epoch": "1582246513.104145000" }, { "tcp_stream": 64, "frame_number": 1626, "display_filter": "frame.number == 1626", "timestamp_epoch": "1582246513.104831000" }, { "tcp_stream": 65, "frame_number": 1632, "display_filter": "frame.number == 1632", "timestamp_epoch": "1582246513.108555000" }, { "tcp_stream": 65, "frame_number": 1635, "display_filter": "frame.number == 1635", "timestamp_epoch": "1582246513.111313000" }, { "tcp_stream": 65, "frame_number": 1640, "display_filter": "frame.number == 1640", "timestamp_epoch": "1582246513.114338000" }, { "tcp_stream": 65, "frame_number": 1642, "display_filter": "frame.number == 1642", "timestamp_epoch": "1582246513.116444000" }, { "tcp_stream": 64, "frame_number": 1646, "display_filter": "frame.number == 1646", "timestamp_epoch": "1582246513.117058000" }, { "tcp_stream": 71, "frame_number": 1835, "display_filter": "frame.number == 1835", "timestamp_epoch": "1582246733.548318000" }, { "tcp_stream": 71, "frame_number": 1840, "display_filter": "frame.number == 1840", "timestamp_epoch": "1582246733.549398000" }, { "tcp_stream": 71, "frame_number": 1843, "display_filter": "frame.number == 1843", "timestamp_epoch": "1582246733.550467000" }, { "tcp_stream": 71, "frame_number": 1845, "display_filter": "frame.number == 1845", "timestamp_epoch": "1582246733.550964000" }, { "tcp_stream": 71, "frame_number": 1847, "display_filter": "frame.number == 1847", "timestamp_epoch": "1582246733.551361000" }, { "tcp_stream": 72, "frame_number": 1853, "display_filter": "frame.number == 1853", "timestamp_epoch": "1582246733.554288000" }, { "tcp_stream": 72, "frame_number": 1856, "display_filter": "frame.number == 1856", "timestamp_epoch": "1582246733.555328000" }, { "tcp_stream": 72, "frame_number": 1861, "display_filter": "frame.number == 1861", "timestamp_epoch": "1582246733.555958000" }, { "tcp_stream": 72, "frame_number": 1863, "display_filter": "frame.number == 1863", "timestamp_epoch": "1582246733.556438000" }, { "tcp_stream": 71, "frame_number": 1867, "display_filter": "frame.number == 1867", "timestamp_epoch": "1582246733.556787000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-aa69bdb461c237cd815f5b4d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.174", "protocol": "samr", "destination": "172.17.8.8", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 39, "frame_number": 810, "display_filter": "frame.number == 810", "timestamp_epoch": "1582246452.244930000" }, { "tcp_stream": 39, "frame_number": 812, "display_filter": "frame.number == 812", "timestamp_epoch": "1582246452.246938000" }, { "tcp_stream": 39, "frame_number": 814, "display_filter": "frame.number == 814", "timestamp_epoch": "1582246452.252105000" }, { "tcp_stream": 39, "frame_number": 816, "display_filter": "frame.number == 816", "timestamp_epoch": "1582246452.253406000" }, { "tcp_stream": 39, "frame_number": 818, "display_filter": "frame.number == 818", "timestamp_epoch": "1582246452.254816000" }, { "tcp_stream": 39, "frame_number": 820, "display_filter": "frame.number == 820", "timestamp_epoch": "1582246452.255918000" }, { "tcp_stream": 39, "frame_number": 822, "display_filter": "frame.number == 822", "timestamp_epoch": "1582246452.257049000" }, { "tcp_stream": 39, "frame_number": 824, "display_filter": "frame.number == 824", "timestamp_epoch": "1582246452.263816000" }, { "tcp_stream": 39, "frame_number": 826, "display_filter": "frame.number == 826", "timestamp_epoch": "1582246452.265047000" }, { "tcp_stream": 39, "frame_number": 828, "display_filter": "frame.number == 828", "timestamp_epoch": "1582246452.267353000" }, { "tcp_stream": 39, "frame_number": 830, "display_filter": "frame.number == 830", "timestamp_epoch": "1582246452.269551000" }, { "tcp_stream": 39, "frame_number": 832, "display_filter": "frame.number == 832", "timestamp_epoch": "1582246452.270287000" }, { "tcp_stream": 39, "frame_number": 834, "display_filter": "frame.number == 834", "timestamp_epoch": "1582246452.271503000" }, { "tcp_stream": 39, "frame_number": 836, "display_filter": "frame.number == 836", "timestamp_epoch": "1582246452.272331000" }, { "tcp_stream": 39, "frame_number": 841, "display_filter": "frame.number == 841", "timestamp_epoch": "1582246452.274434000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-bc4b4e4796bf695a30d75b5d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.8", "protocol": "drsuapi", "destination": "172.17.8.174", "event_count": 38, "operation_numbers": [ "0", "1", "12", "30" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 15, "frame_number": 232, "display_filter": "frame.number == 232", "timestamp_epoch": "1582246432.463888000" }, { "tcp_stream": 15, "frame_number": 234, "display_filter": "frame.number == 234", "timestamp_epoch": "1582246432.464298000" }, { "tcp_stream": 15, "frame_number": 236, "display_filter": "frame.number == 236", "timestamp_epoch": "1582246432.464501000" }, { "tcp_stream": 15, "frame_number": 246, "display_filter": "frame.number == 246", "timestamp_epoch": "1582246432.466656000" }, { "tcp_stream": 15, "frame_number": 248, "display_filter": "frame.number == 248", "timestamp_epoch": "1582246432.467302000" }, { "tcp_stream": 15, "frame_number": 250, "display_filter": "frame.number == 250", "timestamp_epoch": "1582246432.468292000" }, { "tcp_stream": 15, "frame_number": 291, "display_filter": "frame.number == 291", "timestamp_epoch": "1582246432.655968000" }, { "tcp_stream": 15, "frame_number": 293, "display_filter": "frame.number == 293", "timestamp_epoch": "1582246432.656387000" }, { "tcp_stream": 15, "frame_number": 295, "display_filter": "frame.number == 295", "timestamp_epoch": "1582246432.656896000" }, { "tcp_stream": 15, "frame_number": 297, "display_filter": "frame.number == 297", "timestamp_epoch": "1582246432.657880000" }, { "tcp_stream": 26, "frame_number": 537, "display_filter": "frame.number == 537", "timestamp_epoch": "1582246434.444515000" }, { "tcp_stream": 26, "frame_number": 539, "display_filter": "frame.number == 539", "timestamp_epoch": "1582246434.445323000" }, { "tcp_stream": 26, "frame_number": 541, "display_filter": "frame.number == 541", "timestamp_epoch": "1582246434.445734000" }, { "tcp_stream": 26, "frame_number": 545, "display_filter": "frame.number == 545", "timestamp_epoch": "1582246434.447310000" }, { "tcp_stream": 26, "frame_number": 547, "display_filter": "frame.number == 547", "timestamp_epoch": "1582246434.447843000" }, { "tcp_stream": 26, "frame_number": 549, "display_filter": "frame.number == 549", "timestamp_epoch": "1582246434.448275000" }, { "tcp_stream": 15, "frame_number": 766, "display_filter": "frame.number == 766", "timestamp_epoch": "1582246452.174305000" }, { "tcp_stream": 15, "frame_number": 768, "display_filter": "frame.number == 768", "timestamp_epoch": "1582246452.175070000" }, { "tcp_stream": 15, "frame_number": 770, "display_filter": "frame.number == 770", "timestamp_epoch": "1582246452.176141000" }, { "tcp_stream": 15, "frame_number": 772, "display_filter": "frame.number == 772", "timestamp_epoch": "1582246452.176489000" }, { "tcp_stream": 53, "frame_number": 1125, "display_filter": "frame.number == 1125", "timestamp_epoch": "1582246463.999345000" }, { "tcp_stream": 53, "frame_number": 1127, "display_filter": "frame.number == 1127", "timestamp_epoch": "1582246463.999900000" }, { "tcp_stream": 53, "frame_number": 1129, "display_filter": "frame.number == 1129", "timestamp_epoch": "1582246464.000256000" }, { "tcp_stream": 53, "frame_number": 1133, "display_filter": "frame.number == 1133", "timestamp_epoch": "1582246464.002238000" }, { "tcp_stream": 53, "frame_number": 1135, "display_filter": "frame.number == 1135", "timestamp_epoch": "1582246464.002797000" }, { "tcp_stream": 53, "frame_number": 1137, "display_filter": "frame.number == 1137", "timestamp_epoch": "1582246464.003245000" }, { "tcp_stream": 63, "frame_number": 1598, "display_filter": "frame.number == 1598", "timestamp_epoch": "1582246513.088266000" }, { "tcp_stream": 63, "frame_number": 1600, "display_filter": "frame.number == 1600", "timestamp_epoch": "1582246513.091676000" }, { "tcp_stream": 63, "frame_number": 1602, "display_filter": "frame.number == 1602", "timestamp_epoch": "1582246513.092369000" }, { "tcp_stream": 63, "frame_number": 1606, "display_filter": "frame.number == 1606", "timestamp_epoch": "1582246513.094569000" }, { "tcp_stream": 63, "frame_number": 1608, "display_filter": "frame.number == 1608", "timestamp_epoch": "1582246513.095269000" }, { "tcp_stream": 63, "frame_number": 1610, "display_filter": "frame.number == 1610", "timestamp_epoch": "1582246513.095690000" }, { "tcp_stream": 70, "frame_number": 1819, "display_filter": "frame.number == 1819", "timestamp_epoch": "1582246733.538215000" }, { "tcp_stream": 70, "frame_number": 1821, "display_filter": "frame.number == 1821", "timestamp_epoch": "1582246733.541165000" }, { "tcp_stream": 70, "frame_number": 1823, "display_filter": "frame.number == 1823", "timestamp_epoch": "1582246733.544149000" }, { "tcp_stream": 70, "frame_number": 1827, "display_filter": "frame.number == 1827", "timestamp_epoch": "1582246733.545613000" }, { "tcp_stream": 70, "frame_number": 1829, "display_filter": "frame.number == 1829", "timestamp_epoch": "1582246733.546098000" }, { "tcp_stream": 70, "frame_number": 1831, "display_filter": "frame.number == 1831", "timestamp_epoch": "1582246733.546473000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-8fa5f219e278b29a7ffe677f", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.8", "protocol": "ldap", "destination": "172.17.8.174", "event_count": 69, "operation_numbers": [ "", "1", "4,19,19,19,5", "4,5", "5" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 0, "frame_number": 24, "display_filter": "frame.number == 24", "timestamp_epoch": "1582246431.267356000" }, { "tcp_stream": 4, "frame_number": 82, "display_filter": "frame.number == 82", "timestamp_epoch": "1582246432.382998000" }, { "tcp_stream": 4, "frame_number": 188, "display_filter": "frame.number == 188", "timestamp_epoch": "1582246432.414895000" }, { "tcp_stream": 0, "frame_number": 191, "display_filter": "frame.number == 191", "timestamp_epoch": "1582246432.415230000" }, { "tcp_stream": 4, "frame_number": 201, "display_filter": "frame.number == 201", "timestamp_epoch": "1582246432.416696000" }, { "tcp_stream": 4, "frame_number": 208, "display_filter": "frame.number == 208", "timestamp_epoch": "1582246432.418850000" }, { "tcp_stream": 4, "frame_number": 264, "display_filter": "frame.number == 264", "timestamp_epoch": "1582246432.537130000" }, { "tcp_stream": 4, "frame_number": 277, "display_filter": "frame.number == 277", "timestamp_epoch": "1582246432.652025000" }, { "tcp_stream": 4, "frame_number": 310, "display_filter": "frame.number == 310", "timestamp_epoch": "1582246432.774233000" }, { "tcp_stream": 4, "frame_number": 319, "display_filter": "frame.number == 319", "timestamp_epoch": "1582246432.779134000" }, { "tcp_stream": 4, "frame_number": 321, "display_filter": "frame.number == 321", "timestamp_epoch": "1582246432.779569000" }, { "tcp_stream": 20, "frame_number": 331, "display_filter": "frame.number == 331", "timestamp_epoch": "1582246432.988339000" }, { "tcp_stream": 20, "frame_number": 336, "display_filter": "frame.number == 336", "timestamp_epoch": "1582246432.990383000" }, { "tcp_stream": 20, "frame_number": 350, "display_filter": "frame.number == 350", "timestamp_epoch": "1582246433.010584000" }, { "tcp_stream": 22, "frame_number": 357, "display_filter": "frame.number == 357", "timestamp_epoch": "1582246433.013978000" }, { "tcp_stream": 22, "frame_number": 359, "display_filter": "frame.number == 359", "timestamp_epoch": "1582246433.014608000" }, { "tcp_stream": 22, "frame_number": 361, "display_filter": "frame.number == 361", "timestamp_epoch": "1582246433.014965000" }, { "tcp_stream": 20, "frame_number": 363, "display_filter": "frame.number == 363", "timestamp_epoch": "1582246433.015723000" }, { "tcp_stream": 27, "frame_number": 555, "display_filter": "frame.number == 555", "timestamp_epoch": "1582246434.450943000" }, { "tcp_stream": 27, "frame_number": 560, "display_filter": "frame.number == 560", "timestamp_epoch": "1582246434.452516000" }, { "tcp_stream": 27, "frame_number": 562, "display_filter": "frame.number == 562", "timestamp_epoch": "1582246434.453146000" }, { "tcp_stream": 27, "frame_number": 564, "display_filter": "frame.number == 564", "timestamp_epoch": "1582246434.453641000" }, { "tcp_stream": 27, "frame_number": 566, "display_filter": "frame.number == 566", "timestamp_epoch": "1582246434.454101000" }, { "tcp_stream": 28, "frame_number": 573, "display_filter": "frame.number == 573", "timestamp_epoch": "1582246434.457650000" }, { "tcp_stream": 28, "frame_number": 577, "display_filter": "frame.number == 577", "timestamp_epoch": "1582246434.458348000" }, { "tcp_stream": 28, "frame_number": 580, "display_filter": "frame.number == 580", "timestamp_epoch": "1582246434.458952000" }, { "tcp_stream": 30, "frame_number": 624, "display_filter": "frame.number == 624", "timestamp_epoch": "1582246441.616977000" }, { "tcp_stream": 30, "frame_number": 629, "display_filter": "frame.number == 629", "timestamp_epoch": "1582246441.619162000" }, { "tcp_stream": 30, "frame_number": 631, "display_filter": "frame.number == 631", "timestamp_epoch": "1582246441.621377000" }, { "tcp_stream": 30, "frame_number": 633, "display_filter": "frame.number == 633", "timestamp_epoch": "1582246441.622030000" }, { "tcp_stream": 30, "frame_number": 635, "display_filter": "frame.number == 635", "timestamp_epoch": "1582246441.622529000" }, { "tcp_stream": 30, "frame_number": 637, "display_filter": "frame.number == 637", "timestamp_epoch": "1582246441.623038000" }, { "tcp_stream": 30, "frame_number": 639, "display_filter": "frame.number == 639", "timestamp_epoch": "1582246441.623660000" }, { "tcp_stream": 44, "frame_number": 896, "display_filter": "frame.number == 896", "timestamp_epoch": "1582246452.516651000" }, { "tcp_stream": 44, "frame_number": 898, "display_filter": "frame.number == 898", "timestamp_epoch": "1582246452.524221000" }, { "tcp_stream": 45, "frame_number": 905, "display_filter": "frame.number == 905", "timestamp_epoch": "1582246452.532464000" }, { "tcp_stream": 45, "frame_number": 907, "display_filter": "frame.number == 907", "timestamp_epoch": "1582246452.533292000" }, { "tcp_stream": 45, "frame_number": 909, "display_filter": "frame.number == 909", "timestamp_epoch": "1582246452.534025000" }, { "tcp_stream": 44, "frame_number": 911, "display_filter": "frame.number == 911", "timestamp_epoch": "1582246452.535450000" }, { "tcp_stream": 54, "frame_number": 1143, "display_filter": "frame.number == 1143", "timestamp_epoch": "1582246464.007395000" }, { "tcp_stream": 54, "frame_number": 1148, "display_filter": "frame.number == 1148", "timestamp_epoch": "1582246464.009550000" }, { "tcp_stream": 54, "frame_number": 1150, "display_filter": "frame.number == 1150", "timestamp_epoch": "1582246464.010829000" }, { "tcp_stream": 54, "frame_number": 1152, "display_filter": "frame.number == 1152", "timestamp_epoch": "1582246464.011315000" }, { "tcp_stream": 54, "frame_number": 1154, "display_filter": "frame.number == 1154", "timestamp_epoch": "1582246464.011774000" }, { "tcp_stream": 55, "frame_number": 1161, "display_filter": "frame.number == 1161", "timestamp_epoch": "1582246464.016242000" }, { "tcp_stream": 55, "frame_number": 1165, "display_filter": "frame.number == 1165", "timestamp_epoch": "1582246464.017000000" }, { "tcp_stream": 55, "frame_number": 1168, "display_filter": "frame.number == 1168", "timestamp_epoch": "1582246464.017584000" }, { "tcp_stream": 57, "frame_number": 1195, "display_filter": "frame.number == 1195", "timestamp_epoch": "1582246464.653373000" }, { "tcp_stream": 57, "frame_number": 1200, "display_filter": "frame.number == 1200", "timestamp_epoch": "1582246464.659378000" }, { "tcp_stream": 57, "frame_number": 1202, "display_filter": "frame.number == 1202", "timestamp_epoch": "1582246464.669484000" }, { "tcp_stream": 59, "frame_number": 1319, "display_filter": "frame.number == 1319", "timestamp_epoch": "1582246503.646297000" }, { "tcp_stream": 59, "frame_number": 1324, "display_filter": "frame.number == 1324", "timestamp_epoch": "1582246503.649225000" }, { "tcp_stream": 59, "frame_number": 1326, "display_filter": "frame.number == 1326", "timestamp_epoch": "1582246503.651824000" }, { "tcp_stream": 64, "frame_number": 1616, "display_filter": "frame.number == 1616", "timestamp_epoch": "1582246513.098286000" }, { "tcp_stream": 64, "frame_number": 1621, "display_filter": "frame.number == 1621", "timestamp_epoch": "1582246513.100279000" }, { "tcp_stream": 64, "frame_number": 1623, "display_filter": "frame.number == 1623", "timestamp_epoch": "1582246513.103317000" }, { "tcp_stream": 64, "frame_number": 1625, "display_filter": "frame.number == 1625", "timestamp_epoch": "1582246513.104523000" }, { "tcp_stream": 64, "frame_number": 1627, "display_filter": "frame.number == 1627", "timestamp_epoch": "1582246513.105085000" }, { "tcp_stream": 65, "frame_number": 1634, "display_filter": "frame.number == 1634", "timestamp_epoch": "1582246513.110275000" }, { "tcp_stream": 65, "frame_number": 1638, "display_filter": "frame.number == 1638", "timestamp_epoch": "1582246513.112196000" }, { "tcp_stream": 65, "frame_number": 1641, "display_filter": "frame.number == 1641", "timestamp_epoch": "1582246513.115889000" }, { "tcp_stream": 71, "frame_number": 1837, "display_filter": "frame.number == 1837", "timestamp_epoch": "1582246733.548600000" }, { "tcp_stream": 71, "frame_number": 1842, "display_filter": "frame.number == 1842", "timestamp_epoch": "1582246733.550086000" }, { "tcp_stream": 71, "frame_number": 1844, "display_filter": "frame.number == 1844", "timestamp_epoch": "1582246733.550704000" }, { "tcp_stream": 71, "frame_number": 1846, "display_filter": "frame.number == 1846", "timestamp_epoch": "1582246733.551138000" }, { "tcp_stream": 71, "frame_number": 1848, "display_filter": "frame.number == 1848", "timestamp_epoch": "1582246733.551553000" }, { "tcp_stream": 72, "frame_number": 1855, "display_filter": "frame.number == 1855", "timestamp_epoch": "1582246733.554929000" }, { "tcp_stream": 72, "frame_number": 1859, "display_filter": "frame.number == 1859", "timestamp_epoch": "1582246733.555636000" }, { "tcp_stream": 72, "frame_number": 1862, "display_filter": "frame.number == 1862", "timestamp_epoch": "1582246733.556171000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-727447b4f1accc52d463c78d", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" }, { "title": "Directory-service protocol activity", "status": "candidate", "metrics": { "source": "172.17.8.8", "protocol": "samr", "destination": "172.17.8.174", "event_count": 15, "operation_numbers": [ "1", "16", "17", "3", "34", "36", "39", "5", "6", "64", "7" ] }, "rule_id": "directory-service-activity", "evidence": [ { "tcp_stream": 39, "frame_number": 811, "display_filter": "frame.number == 811", "timestamp_epoch": "1582246452.245395000" }, { "tcp_stream": 39, "frame_number": 813, "display_filter": "frame.number == 813", "timestamp_epoch": "1582246452.247258000" }, { "tcp_stream": 39, "frame_number": 815, "display_filter": "frame.number == 815", "timestamp_epoch": "1582246452.252439000" }, { "tcp_stream": 39, "frame_number": 817, "display_filter": "frame.number == 817", "timestamp_epoch": "1582246452.253801000" }, { "tcp_stream": 39, "frame_number": 819, "display_filter": "frame.number == 819", "timestamp_epoch": "1582246452.255215000" }, { "tcp_stream": 39, "frame_number": 821, "display_filter": "frame.number == 821", "timestamp_epoch": "1582246452.256417000" }, { "tcp_stream": 39, "frame_number": 823, "display_filter": "frame.number == 823", "timestamp_epoch": "1582246452.257538000" }, { "tcp_stream": 39, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1582246452.264291000" }, { "tcp_stream": 39, "frame_number": 827, "display_filter": "frame.number == 827", "timestamp_epoch": "1582246452.265455000" }, { "tcp_stream": 39, "frame_number": 829, "display_filter": "frame.number == 829", "timestamp_epoch": "1582246452.267813000" }, { "tcp_stream": 39, "frame_number": 831, "display_filter": "frame.number == 831", "timestamp_epoch": "1582246452.269872000" }, { "tcp_stream": 39, "frame_number": 833, "display_filter": "frame.number == 833", "timestamp_epoch": "1582246452.270601000" }, { "tcp_stream": 39, "frame_number": 835, "display_filter": "frame.number == 835", "timestamp_epoch": "1582246452.271788000" }, { "tcp_stream": 39, "frame_number": 837, "display_filter": "frame.number == 837", "timestamp_epoch": "1582246452.272637000" }, { "tcp_stream": 39, "frame_number": 842, "display_filter": "frame.number == 842", "timestamp_epoch": "1582246452.274812000" } ], "severity": "low", "confidence": 0.95, "finding_id": "finding-45acac4ef97bd8b4a00693ac", "explanation": "Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.", "rule_version": "pcap-rules-v5" } ], "artifacts": [ { "md5": "1fbd6e0a138ad489de433b9bda2970d5", "sha1": "2feb83b309c1433581e9c8057a1a6ee06905c079", "type": "http-exported-object", "sha256": "9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86", "evidence": [ { "tcp_stream": 125, "frame_number": 8133, "display_filter": "frame.number == 8133", "timestamp_epoch": "1582247650.409278000" } ], "filename": "ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d(2)", "filenames": [ "ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d(2)" ], "transfers": [ { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 125, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 7398, "response_frame": 8133 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 629753, "artifact_id": "artifact-493d6a59f15736c443331581", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "zip", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "64aabb8c0ca6245f28dc0d7936208706", "sha1": "5c3353be0c746f65ff1bb04bd442a956fb3a2c00", "type": "http-exported-object", "sha256": "03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066", "evidence": [ { "tcp_stream": 60, "frame_number": 1566, "display_filter": "frame.number == 1566", "timestamp_epoch": "1582246508.624645000" } ], "filename": "yrkbdmt.bin", "filenames": [ "yrkbdmt.bin" ], "transfers": [ { "url": "http://blueflag.xyz/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin", "client_ip": "172.17.8.174", "server_ip": "49.51.172.56", "tcp_stream": 60, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 1340, "response_frame": 1566 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 208896, "artifact_id": "artifact-b5a7ebcc669f6e376c5917e8", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 208896, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": "executable", "features": [], "content_kind": "pe", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 208896, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "efebf1ede6670adf677cfa52a6a3b24f", "sha1": "cf437ba0d4484a2edc7988b5e061485f42d43692", "type": "http-exported-object", "sha256": "bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0", "evidence": [ { "tcp_stream": 120, "frame_number": 7394, "display_filter": "frame.number == 7394", "timestamp_epoch": "1582247649.805032000" } ], "filename": "001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d(2)", "filenames": [ "001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d(2)" ], "transfers": [ { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.10", "tcp_stream": 120, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 5894, "response_frame": 7394 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 791389, "artifact_id": "artifact-b59141292569f9e533d46093", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "1c6ac712e341211921fad4a33f4175c3", "sha1": "2f4bb847fdefc74c10c6b2940a9cb5ef87a20d86", "type": "http-exported-object", "sha256": "647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78", "evidence": [ { "tcp_stream": 128, "frame_number": 8906, "display_filter": "frame.number == 8906", "timestamp_epoch": "1582247651.003698000" } ], "filename": "9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d(2)", "filenames": [ "9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d(2)" ], "transfers": [ { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 128, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 7969, "response_frame": 8906 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 659511, "artifact_id": "artifact-52576801210afc718b4d6856", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "dfc0902938b6ec9c616dc6d3203d2f01", "sha1": "3a9d42bca9b113a48bdafc938e32260588928d2f", "type": "http-exported-object", "sha256": "6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc", "evidence": [ { "tcp_stream": 117, "frame_number": 6653, "display_filter": "frame.number == 6653", "timestamp_epoch": "1582247649.464172000" } ], "filename": "0092fb1c-d27f-429c-acdd-29b392ed3d33%3fP1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d(2)", "filenames": [ "0092fb1c-d27f-429c-acdd-29b392ed3d33%3fP1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d(2)" ], "transfers": [ { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 117, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 5896, "response_frame": 6653 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 519620, "artifact_id": "artifact-75137de314872836f7add8ce", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": true, "identities": [], "inspected_bytes": 262144, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 262144, "inspection_truncated": true }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "c70b224c70055fed8774ce8918e5ba55", "sha1": "20018f98272589d9029983b59a24e1d7a33c43f2", "type": "http-exported-object", "sha256": "a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961", "evidence": [ { "tcp_stream": 126, "frame_number": 7492, "display_filter": "frame.number == 7492", "timestamp_epoch": "1582247650.050844000" } ], "filename": "pieceshash(2)", "filenames": [ "pieceshash(2)" ], "transfers": [ { "url": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash", "client_ip": "172.17.8.174", "server_ip": "13.107.4.50", "tcp_stream": 126, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 7409, "response_frame": 7492 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1328, "artifact_id": "artifact-816b69f58c8dbfed92de4218", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1328, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1328, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "b418325e6216c8b4ae84dffe52ef94df", "sha1": "2c653ebc284f131243a6d6b3de98e8c4fc5118ec", "type": "http-exported-object", "sha256": "f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513", "evidence": [ { "tcp_stream": 130, "frame_number": 8939, "display_filter": "frame.number == 8939", "timestamp_epoch": "1582247651.438566000" } ], "filename": "pieceshash(3)", "filenames": [ "pieceshash(3)" ], "transfers": [ { "url": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash", "client_ip": "172.17.8.174", "server_ip": "13.107.4.50", "tcp_stream": 130, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 8927, "response_frame": 8939 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 1140, "artifact_id": "artifact-e9d1e586e4ff129a8535b813", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 1140, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 1140, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "0c4798d76acbb2c2056233dd319d9a88", "sha1": "17a18d621840ecb17c8af2eeafa30b93a1d527ab", "type": "http-exported-object", "sha256": "7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48", "evidence": [ { "tcp_stream": 109, "frame_number": 5767, "display_filter": "frame.number == 5767", "timestamp_epoch": "1582247647.497481000" } ], "filename": "pieceshash", "filenames": [ "pieceshash" ], "transfers": [ { "url": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash", "client_ip": "172.17.8.174", "server_ip": "13.107.4.50", "tcp_stream": 109, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 5753, "response_frame": 5767 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 293, "artifact_id": "artifact-76c16c440af2f50ee2fa72ff", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 293, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 293, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d58d73c26d3d4376db2fdc5203c1a74b", "sha1": "3db76e52d8bf1b55f1d48057a7e166430ab02714", "type": "http-exported-object", "sha256": "166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e", "evidence": [ { "tcp_stream": 122, "frame_number": 6773, "display_filter": "frame.number == 6773", "timestamp_epoch": "1582247649.565924000" } ], "filename": "pieceshash(1)", "filenames": [ "pieceshash(1)" ], "transfers": [ { "url": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash", "client_ip": "172.17.8.174", "server_ip": "13.107.4.50", "tcp_stream": 122, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "200", "completeness": "matches-declared-content-length", "request_frame": 6576, "response_frame": 6773 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 198, "artifact_id": "artifact-eb8612555d0f6544bce06e98", "occurrences": 1, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 198, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 198, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false }, { "md5": "d71bdd22c8bb93b8d287dce6f46aed25", "sha1": "e14e7438ed45ff5dc2ea8f847854b2fdc2afe1cf", "type": "http-exported-object", "sha256": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "evidence": [ { "tcp_stream": 117, "frame_number": 5890, "display_filter": "frame.number == 5890", "timestamp_epoch": "1582247648.960052000" }, { "tcp_stream": 118, "frame_number": 5891, "display_filter": "frame.number == 5891", "timestamp_epoch": "1582247648.960119000" }, { "tcp_stream": 119, "frame_number": 5892, "display_filter": "frame.number == 5892", "timestamp_epoch": "1582247648.960131000" }, { "tcp_stream": 120, "frame_number": 5893, "display_filter": "frame.number == 5893", "timestamp_epoch": "1582247648.960138000" }, { "tcp_stream": 125, "frame_number": 7395, "display_filter": "frame.number == 7395", "timestamp_epoch": "1582247649.805067000" }, { "tcp_stream": 124, "frame_number": 7396, "display_filter": "frame.number == 7396", "timestamp_epoch": "1582247649.805075000" }, { "tcp_stream": 128, "frame_number": 7957, "display_filter": "frame.number == 7957", "timestamp_epoch": "1582247650.349044000" }, { "tcp_stream": 127, "frame_number": 8053, "display_filter": "frame.number == 8053", "timestamp_epoch": "1582247650.385852000" }, { "tcp_stream": 131, "frame_number": 8973, "display_filter": "frame.number == 8973", "timestamp_epoch": "1582247651.589879000" }, { "tcp_stream": 132, "frame_number": 8974, "display_filter": "frame.number == 8974", "timestamp_epoch": "1582247651.589890000" }, { "tcp_stream": 136, "frame_number": 9001, "display_filter": "frame.number == 9001", "timestamp_epoch": "1582247651.729632000" }, { "tcp_stream": 135, "frame_number": 9002, "display_filter": "frame.number == 9002", "timestamp_epoch": "1582247651.729665000" } ], "filename": "001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "filenames": [ "001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "001eb2ac-b2c2-4a55-a78d-85def1f04de3%3fP1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d(1)", "0092fb1c-d27f-429c-acdd-29b392ed3d33%3fP1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "0092fb1c-d27f-429c-acdd-29b392ed3d33%3fP1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d(1)", "9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d(1)", "9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d(3)", "9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf%3fP1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d(4)", "ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d(1)", "ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d(3)", "ae6344f1-6475-4365-b7bd-43e79abac1fb%3fP1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d(4)" ], "transfers": [ { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 117, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 5870, "response_frame": 5890 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.10", "tcp_stream": 118, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 5880, "response_frame": 5891 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 119, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 5882, "response_frame": 5892 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.10", "tcp_stream": 120, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 5884, "response_frame": 5893 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 125, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 7069, "response_frame": 7395 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.10", "tcp_stream": 124, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 7066, "response_frame": 7396 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 128, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 7710, "response_frame": 7957 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.10", "tcp_stream": 127, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 7720, "response_frame": 8053 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.42", "tcp_stream": 131, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 8949, "response_frame": 8973 }, { "url": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "client_ip": "172.17.8.174", "server_ip": "205.185.216.10", "tcp_stream": 132, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 8951, "response_frame": 8974 }, { "url": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "client_ip": "172.17.8.174", "server_ip": "23.1.236.92", "tcp_stream": 136, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 8991, "response_frame": 9001 }, { "url": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "client_ip": "172.17.8.174", "server_ip": "23.1.236.114", "tcp_stream": 135, "match_basis": "exact-sha256-of-decoded-http-response-body", "status_code": "206", "completeness": "matches-declared-content-length", "request_frame": 8989, "response_frame": 9002 } ], "hash_scope": "exact exported bytes; may be partial or content-decoded, not necessarily the original server file", "media_type": "application/octet-stream", "size_bytes": 2, "artifact_id": "artifact-c110363a0fdc433440455d67", "occurrences": 12, "completeness": "matches-declared-content-length", "body_features": { "scope": "Allowlisted structural features; secret values and arbitrary payload text omitted", "truncated": false, "identities": [], "inspected_bytes": 2, "credential_record_present": false, "private_key_marker_present": false, "system_inventory_marker_present": false }, "static_features": { "pe_kind": null, "features": [], "content_kind": "unclassified", "interpretation": "Static content only; not proof of execution, intent, or malware family", "inspected_bytes": 2, "inspection_truncated": false }, "extraction_method": "tshark-http-export-objects", "transfers_truncated": false, "content_retained_by_analyzer": false } ], "endpoints": [ { "ip": "0.0.0.0", "bytes_sent": 381, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-da7ebdccb2ec5dec2a2b3540", "packets_sent": 1, "mac_addresses": [ "00:11:75:8c:fd:47" ], "bytes_received": 0, "evidence_frames": [ 1 ], "last_seen_epoch": "1582246430.628828", "first_seen_epoch": "1582246430.628828", "packets_received": 0 }, { "ip": "104.77.69.193", "bytes_sent": 45971, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f3deb002b7d72af6e4c34358", "packets_sent": 80, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 8169, "evidence_frames": [ 5660, 5661, 5662, 5663, 5664 ], "last_seen_epoch": "1582247651.336321", "first_seen_epoch": "1582247646.005288", "packets_received": 56 }, { "ip": "13.107.246.10", "bytes_sent": 7768, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-265cb2b4533c78321af78cc7", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2796, "evidence_frames": [ 1943, 1946, 1947, 1948, 1949 ], "last_seen_epoch": "1582246972.244919", "first_seen_epoch": "1582246971.494122", "packets_received": 12 }, { "ip": "13.107.3.128", "bytes_sent": 185663, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8eb52a480226bee6786cb7b6", "packets_sent": 174, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 9063, "evidence_frames": [ 3150, 3151, 3152, 3153, 3154 ], "last_seen_epoch": "1582247394.017845", "first_seen_epoch": "1582247357.675962", "packets_received": 75 }, { "ip": "13.107.3.254", "bytes_sent": 11827, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-292bdd2521306b69f0208666", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2923, "evidence_frames": [ 1036, 1041, 1042, 1043, 1044 ], "last_seen_epoch": "1582247638.864871", "first_seen_epoch": "1582246460.903901", "packets_received": 23 }, { "ip": "13.107.4.254", "bytes_sent": 5309, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f761e0a431f1da7faba4c0cc", "packets_sent": 12, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1032, "evidence_frames": [ 939, 944, 945, 946, 947 ], "last_seen_epoch": "1582246586.95866", "first_seen_epoch": "1582246457.809885", "packets_received": 10 }, { "ip": "13.107.4.50", "bytes_sent": 7571, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e74b29d7ea6a2190957b1e51", "packets_sent": 22, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 2487, "evidence_frames": [ 5743, 5751, 5752, 5753, 5754 ], "last_seen_epoch": "1582247651.530229", "first_seen_epoch": "1582247647.304258", "packets_received": 22 }, { "ip": "172.17.8.1", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-b96e0d24f5f5afd96592bc43", "packets_sent": 0, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4290, "evidence_frames": [ 32, 33, 314, 513, 514 ], "last_seen_epoch": "1582247573.086466", "first_seen_epoch": "1582246432.114052", "packets_received": 39 }, { "ip": "172.17.8.174", "bytes_sent": 525544, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-0b3717e8a73831933313f5c6", "packets_sent": 3170, "mac_addresses": [ "00:11:75:8c:fd:47" ], "bytes_received": 6961225, "evidence_frames": [ 2, 3, 4, 5, 6 ], "last_seen_epoch": "1582247652.153841", "first_seen_epoch": "1582246430.629296", "packets_received": 6527 }, { "ip": "172.17.8.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-bad86102bed0af09c7f6260a", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 2049, "evidence_frames": [ 600, 601, 602, 603, 604 ], "last_seen_epoch": "1582247157.859759", "first_seen_epoch": "1582246436.770248", "packets_received": 15 }, { "ip": "172.17.8.8", "bytes_sent": 174101, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-b764aec33ca9fc86b245abef", "packets_sent": 632, "mac_addresses": [ "00:50:56:f3:8d:ca", "a4:1f:72:c2:09:6a" ], "bytes_received": 184096, "evidence_frames": [ 2, 9, 10, 11, 12 ], "last_seen_epoch": "1582247651.373628", "first_seen_epoch": "1582246430.629296", "packets_received": 725 }, { "ip": "204.79.197.200", "bytes_sent": 43008, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a0eb1c6293ed3dd299a9fd7b", "packets_sent": 91, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 20765, "evidence_frames": [ 925, 927, 930, 932, 933 ], "last_seen_epoch": "1582247531.058977", "first_seen_epoch": "1582246456.612741", "packets_received": 80 }, { "ip": "204.79.197.222", "bytes_sent": 8417, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e95945c88416b1ccb5ea5497", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1986, "evidence_frames": [ 4438, 4439, 4440, 4441, 4442 ], "last_seen_epoch": "1582247639.431212", "first_seen_epoch": "1582247509.813341", "packets_received": 14 }, { "ip": "204.79.197.254", "bytes_sent": 6531, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-ab3004dc2c4543525b8bb827", "packets_sent": 16, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1600, "evidence_frames": [ 4672, 4693, 4701, 4716, 4717 ], "last_seen_epoch": "1582247636.888939", "first_seen_epoch": "1582247513.803818", "packets_received": 13 }, { "ip": "205.185.216.10", "bytes_sent": 831247, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-155e56c9182b7fe6a88e4c3b", "packets_sent": 683, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 18891, "evidence_frames": [ 5791, 5793, 5796, 5798, 5800 ], "last_seen_epoch": "1582247651.643839", "first_seen_epoch": "1582247647.703704", "packets_received": 278 }, { "ip": "205.185.216.42", "bytes_sent": 2412333, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-eb13302c809bd293a31f4b6e", "packets_sent": 1917, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 41415, "evidence_frames": [ 5790, 5792, 5797, 5799, 5801 ], "last_seen_epoch": "1582247652.153841", "first_seen_epoch": "1582247647.703418", "packets_received": 671 }, { "ip": "224.0.0.22", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-8d1173e0a8469b44e03b16db", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:16" ], "bytes_received": 548, "evidence_frames": [ 3, 4, 8, 919, 920 ], "last_seen_epoch": "1582247330.537652", "first_seen_epoch": "1582246430.768143", "packets_received": 10 }, { "ip": "224.0.0.251", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-264c863aef67170eff68c1d8", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fb" ], "bytes_received": 344, "evidence_frames": [ 5, 6, 2223, 2224 ], "last_seen_epoch": "1582247330.05709", "first_seen_epoch": "1582246430.82764", "packets_received": 4 }, { "ip": "224.0.0.252", "bytes_sent": 0, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-f2ba4e255ee9b27a8f5d78c1", "packets_sent": 0, "mac_addresses": [ "01:00:5e:00:00:fc" ], "bytes_received": 150, "evidence_frames": [ 7, 2225 ], "last_seen_epoch": "1582247330.057241", "first_seen_epoch": "1582246430.832491", "packets_received": 2 }, { "ip": "23.1.236.114", "bytes_sent": 1159, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-6eb36d5d7ab6eeaa978c99e7", "packets_sent": 3, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 646, "evidence_frames": [ 8967, 8986, 8988, 8989, 8990 ], "last_seen_epoch": "1582247651.77382", "first_seen_epoch": "1582247651.552914", "packets_received": 4 }, { "ip": "23.1.236.125", "bytes_sent": 58, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-c8bb5659631d5d110de5237a", "packets_sent": 1, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 120, "evidence_frames": [ 5777, 5785, 5786 ], "last_seen_epoch": "1582247647.680939", "first_seen_epoch": "1582247647.598498", "packets_received": 2 }, { "ip": "23.1.236.85", "bytes_sent": 58, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-043348394936ee4d067d3cd2", "packets_sent": 1, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 120, "evidence_frames": [ 5778, 5787, 5788 ], "last_seen_epoch": "1582247647.694701", "first_seen_epoch": "1582247647.59897", "packets_received": 2 }, { "ip": "23.1.236.92", "bytes_sent": 183257, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3a4b88e2e5c40af52cf09181", "packets_sent": 146, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3229, "evidence_frames": [ 8968, 8985, 8987, 8991, 8992 ], "last_seen_epoch": "1582247652.11866", "first_seen_epoch": "1582247651.553678", "packets_received": 44 }, { "ip": "23.54.20.119", "bytes_sent": 1856004, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-52a08538ef961f558f0474bf", "packets_sent": 1418, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 21664, "evidence_frames": [ 2354, 2355, 2356, 2357, 2358 ], "last_seen_epoch": "1582247394.01723", "first_seen_epoch": "1582247355.879843", "packets_received": 387 }, { "ip": "23.54.20.139", "bytes_sent": 6247, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-a70ca7df968afc4d981824bf", "packets_sent": 14, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1112, "evidence_frames": [ 938, 948, 949, 950, 951 ], "last_seen_epoch": "1582247504.473667", "first_seen_epoch": "1582246457.809369", "packets_received": 12 }, { "ip": "255.255.255.255", "bytes_sent": 0, "ip_version": 4, "is_private": true, "endpoint_id": "endpoint-1fee526d14fe968e7853d005", "packets_sent": 0, "mac_addresses": [ "ff:ff:ff:ff:ff:ff" ], "bytes_received": 381, "evidence_frames": [ 1 ], "last_seen_epoch": "1582246430.628828", "first_seen_epoch": "1582246430.628828", "packets_received": 1 }, { "ip": "40.126.5.35", "bytes_sent": 5992, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e5efc4f1cfbc5bbe3bcd3144", "packets_sent": 10, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1539, "evidence_frames": [ 1181, 1186, 1187, 1188, 1189 ], "last_seen_epoch": "1582246466.39988", "first_seen_epoch": "1582246464.272118", "packets_received": 11 }, { "ip": "40.69.216.73", "bytes_sent": 3793, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-3e21383dbac1e46b63ae73b9", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1215, "evidence_frames": [ 5636, 5637, 5638, 5639, 5640 ], "last_seen_epoch": "1582247646.129654", "first_seen_epoch": "1582247644.56405", "packets_received": 11 }, { "ip": "40.91.116.226", "bytes_sent": 12034, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-0f1a56be217eea10a435dc02", "packets_sent": 46, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 28758, "evidence_frames": [ 2037, 2038, 2039, 2040, 2041 ], "last_seen_epoch": "1582247036.929827", "first_seen_epoch": "1582247034.9363", "packets_received": 38 }, { "ip": "49.51.172.56", "bytes_sent": 218510, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bf49a48682cff6bb226266c6", "packets_sent": 173, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 3430, "evidence_frames": [ 1333, 1338, 1339, 1340, 1341 ], "last_seen_epoch": "1582246508.625113", "first_seen_epoch": "1582246506.453005", "packets_received": 60 }, { "ip": "52.109.124.20", "bytes_sent": 7273, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-e49360bca2c81c2d600b1767", "packets_sent": 13, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1614, "evidence_frames": [ 1745, 1746, 1747, 1748, 1749 ], "last_seen_epoch": "1582246695.019046", "first_seen_epoch": "1582246584.857489", "packets_received": 9 }, { "ip": "52.109.2.55", "bytes_sent": 12339, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-819b7d8d26670316d72b8813", "packets_sent": 17, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 4411, "evidence_frames": [ 2321, 2323, 2324, 2325, 2326 ], "last_seen_epoch": "1582247394.016873", "first_seen_epoch": "1582247354.753501", "packets_received": 13 }, { "ip": "52.114.128.9", "bytes_sent": 6680, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-189225ed57a856d14bb5d9b1", "packets_sent": 29, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 21861, "evidence_frames": [ 1235, 1236, 1237, 1238, 1239 ], "last_seen_epoch": "1582246495.84812", "first_seen_epoch": "1582246474.08012", "packets_received": 28 }, { "ip": "52.114.132.22", "bytes_sent": 14754, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-1728a0864300db5886ae90a2", "packets_sent": 33, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 11085, "evidence_frames": [ 678, 679, 680, 681, 682 ], "last_seen_epoch": "1582246883.128214", "first_seen_epoch": "1582246443.045826", "packets_received": 29 }, { "ip": "52.114.76.34", "bytes_sent": 16928, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-adeeac2160e9f63f4685718d", "packets_sent": 54, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 26956, "evidence_frames": [ 1572, 1577, 1578, 1579, 1580 ], "last_seen_epoch": "1582247184.362932", "first_seen_epoch": "1582246512.751544", "packets_received": 51 }, { "ip": "52.159.17.76", "bytes_sent": 22958, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-615629b984427d7cb5bc7865", "packets_sent": 61, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 16809, "evidence_frames": [ 5527, 5528, 5529, 5530, 5531 ], "last_seen_epoch": "1582247644.386213", "first_seen_epoch": "1582247641.966916", "packets_received": 46 }, { "ip": "52.230.222.68", "bytes_sent": 10229, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-7e224801947f286bb2b9c5df", "packets_sent": 28, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 5301, "evidence_frames": [ 1945, 1958, 1959, 1960, 1961 ], "last_seen_epoch": "1582247033.441767", "first_seen_epoch": "1582246971.564554", "packets_received": 22 }, { "ip": "64.4.54.18", "bytes_sent": 28222, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-5e50f69ff2fef385e12ddfe6", "packets_sent": 109, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 53726, "evidence_frames": [ 2123, 2124, 2125, 2126, 2127 ], "last_seen_epoch": "1582247652.153441", "first_seen_epoch": "1582247037.024962", "packets_received": 94 }, { "ip": "72.21.81.200", "bytes_sent": 9147, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-bf4358763aff18b578c9728e", "packets_sent": 18, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 1683, "evidence_frames": [ 4542, 4555, 4556, 4557, 4558 ], "last_seen_epoch": "1582247513.703195", "first_seen_epoch": "1582247513.063354", "packets_received": 15 }, { "ip": "91.211.88.122", "bytes_sent": 805837, "ip_version": 4, "is_private": false, "endpoint_id": "endpoint-56925a7b675e70892ec9068f", "packets_sent": 650, "mac_addresses": [ "20:e5:2a:b6:93:f1" ], "bytes_received": 17661, "evidence_frames": [ 4419, 4420, 4421, 4422, 4423 ], "last_seen_epoch": "1582247524.493527", "first_seen_epoch": "1582247508.283452", "packets_received": 243 } ], "identities": [ { "type": "account", "value": "desktop-tzmkhkc$", "bindings": [ { "account": "", "owner_ip": "172.17.8.174", "frame_number": 87, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 95, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 108, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 111, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 112, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 115, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 120, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 133, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 135, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 158, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 163, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 171, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 190, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 344, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 373, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 385, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 643, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 651, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 653, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 665, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" } ], "evidence": [ { "tcp_stream": 5, "frame_number": 87, "display_filter": "frame.number == 87", "timestamp_epoch": "1582246432.385405000" }, { "tcp_stream": 6, "frame_number": 95, "display_filter": "frame.number == 95", "timestamp_epoch": "1582246432.387731000" }, { "tcp_stream": 8, "frame_number": 108, "display_filter": "frame.number == 108", "timestamp_epoch": "1582246432.396796000" }, { "tcp_stream": 7, "frame_number": 111, "display_filter": "frame.number == 111", "timestamp_epoch": "1582246432.397151000" }, { "tcp_stream": 9, "frame_number": 112, "display_filter": "frame.number == 112", "timestamp_epoch": "1582246432.397245000" }, { "tcp_stream": 7, "frame_number": 115, "display_filter": "frame.number == 115", "timestamp_epoch": "1582246432.398050000" }, { "tcp_stream": 9, "frame_number": 120, "display_filter": "frame.number == 120", "timestamp_epoch": "1582246432.398372000" }, { "tcp_stream": 10, "frame_number": 133, "display_filter": "frame.number == 133", "timestamp_epoch": "1582246432.408105000" }, { "tcp_stream": 10, "frame_number": 135, "display_filter": "frame.number == 135", "timestamp_epoch": "1582246432.408783000" }, { "tcp_stream": 11, "frame_number": 158, "display_filter": "frame.number == 158", "timestamp_epoch": "1582246432.412911000" }, { "tcp_stream": 12, "frame_number": 163, "display_filter": "frame.number == 163", "timestamp_epoch": "1582246432.413267000" }, { "tcp_stream": 13, "frame_number": 171, "display_filter": "frame.number == 171", "timestamp_epoch": "1582246432.413736000" }, { "tcp_stream": 14, "frame_number": 190, "display_filter": "frame.number == 190", "timestamp_epoch": "1582246432.415156000" }, { "tcp_stream": 21, "frame_number": 344, "display_filter": "frame.number == 344", "timestamp_epoch": "1582246433.007594000" }, { "tcp_stream": 23, "frame_number": 373, "display_filter": "frame.number == 373", "timestamp_epoch": "1582246433.098368000" }, { "tcp_stream": 24, "frame_number": 385, "display_filter": "frame.number == 385", "timestamp_epoch": "1582246433.099805000" }, { "tcp_stream": 31, "frame_number": 643, "display_filter": "frame.number == 643", "timestamp_epoch": "1582246441.627639000" }, { "tcp_stream": 32, "frame_number": 651, "display_filter": "frame.number == 651", "timestamp_epoch": "1582246441.628800000" }, { "tcp_stream": 32, "frame_number": 653, "display_filter": "frame.number == 653", "timestamp_epoch": "1582246441.629361000" }, { "tcp_stream": 33, "frame_number": 665, "display_filter": "frame.number == 665", "timestamp_epoch": "1582246441.630896000" } ], "raw_values": [ "DESKTOP-TZMKHKC$", "desktop-tzmkhkc$" ], "identity_id": "identity-4811042a101e4e7cbcbe4e34", "ip_addresses": [ "172.17.8.174" ], "mac_addresses": [ "00:11:75:8c:fd:47" ] }, { "type": "account", "value": "gabriella.ventura", "bindings": [ { "account": "", "owner_ip": "172.17.8.174", "frame_number": 718, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 726, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 728, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 740, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 754, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 796, "relationship": "client-asserted", "source_field": "ntlmssp.auth.username", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" }, { "account": "gabriella.ventura", "owner_ip": null, "frame_number": 825, "relationship": "directory-subject-returned-to-client", "source_field": "samr.samr_UserInfo21.account_name", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 856, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 868, "relationship": "kerberos-client-principal", "source_field": "kerberos.CNameString", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" } ], "evidence": [ { "tcp_stream": 35, "frame_number": 718, "display_filter": "frame.number == 718", "timestamp_epoch": "1582246452.084558000" }, { "tcp_stream": 36, "frame_number": 726, "display_filter": "frame.number == 726", "timestamp_epoch": "1582246452.096627000" }, { "tcp_stream": 36, "frame_number": 728, "display_filter": "frame.number == 728", "timestamp_epoch": "1582246452.097349000" }, { "tcp_stream": 37, "frame_number": 740, "display_filter": "frame.number == 740", "timestamp_epoch": "1582246452.099035000" }, { "tcp_stream": 38, "frame_number": 754, "display_filter": "frame.number == 754", "timestamp_epoch": "1582246452.171263000" }, { "tcp_stream": 39, "frame_number": 796, "display_filter": "frame.number == 796", "timestamp_epoch": "1582246452.213891000" }, { "tcp_stream": 39, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1582246452.264291000" }, { "tcp_stream": 42, "frame_number": 856, "display_filter": "frame.number == 856", "timestamp_epoch": "1582246452.310445000" }, { "tcp_stream": 43, "frame_number": 868, "display_filter": "frame.number == 868", "timestamp_epoch": "1582246452.313300000" } ], "raw_values": [ "gabriella.ventura" ], "identity_id": "identity-cd36d09ea68cc61f133fa198", "ip_addresses": [ "172.17.8.174" ], "mac_addresses": [ "00:11:75:8c:fd:47" ] }, { "type": "domain", "value": "ONE-HOT-MESS", "bindings": [ { "account": "", "owner_ip": "172.17.8.174", "frame_number": 796, "relationship": "client-asserted", "source_field": "ntlmssp.auth.domain", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" } ], "evidence": [ { "tcp_stream": 39, "frame_number": 796, "display_filter": "frame.number == 796", "timestamp_epoch": "1582246452.213891000" } ], "raw_values": [ "ONE-HOT-MESS" ], "identity_id": "identity-83ec0ccca7e7015407c2b630", "ip_addresses": [ "172.17.8.174" ], "mac_addresses": [ "00:11:75:8c:fd:47" ] }, { "type": "full-name", "value": "Gabriella Ventura", "bindings": [ { "account": "gabriella.ventura", "owner_ip": "172.17.8.174", "frame_number": 825, "relationship": "directory-name-correlated-with-client-principal", "source_field": "samr.samr_UserInfo21.full_name", "conversation_dst": "172.17.8.174", "conversation_src": "172.17.8.8" } ], "evidence": [ { "tcp_stream": 39, "frame_number": 825, "display_filter": "frame.number == 825", "timestamp_epoch": "1582246452.264291000" } ], "raw_values": [ "Gabriella Ventura" ], "identity_id": "identity-afe130e0eddde147e2c0ada3", "ip_addresses": [ "172.17.8.174" ], "mac_addresses": [] }, { "type": "hostname", "value": "DESKTOP-5NCFYEU", "bindings": [ { "account": "", "owner_ip": "172.17.8.174", "frame_number": 796, "relationship": "client-asserted", "source_field": "ntlmssp.auth.hostname", "conversation_dst": "172.17.8.8", "conversation_src": "172.17.8.174" } ], "evidence": [ { "tcp_stream": 39, "frame_number": 796, "display_filter": "frame.number == 796", "timestamp_epoch": "1582246452.213891000" } ], "raw_values": [ "DESKTOP-5NCFYEU" ], "identity_id": "identity-03c1a127f49c3141aed116e1", "ip_addresses": [ "172.17.8.174" ], "mac_addresses": [ "00:11:75:8c:fd:47" ] }, { "type": "hostname", "value": "DESKTOP-TZMKHKC", "bindings": [ { "account": "", "owner_ip": "0.0.0.0", "frame_number": 1, "relationship": "dhcp-client-assertion", "source_field": "dhcp.option.hostname", "conversation_dst": "255.255.255.255", "conversation_src": "0.0.0.0" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 32, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 314, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 514, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 515, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 593, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 595, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 601, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 602, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 603, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 605, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 607, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 610, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 611, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 613, "relationship": "netbios-registration", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 616, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 1791, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": "172.17.8.174", "frame_number": 2184, "relationship": "client-asserted", "source_field": "browser.server", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" } ], "evidence": [ { "udp_stream": 0, "frame_number": 1, "display_filter": "frame.number == 1", "timestamp_epoch": "1582246430.628828000" }, { "udp_stream": 12, "frame_number": 32, "display_filter": "frame.number == 32", "timestamp_epoch": "1582246432.114052000" }, { "udp_stream": 12, "frame_number": 314, "display_filter": "frame.number == 314", "timestamp_epoch": "1582246432.776672000" }, { "udp_stream": 12, "frame_number": 514, "display_filter": "frame.number == 514", "timestamp_epoch": "1582246433.612559000" }, { "udp_stream": 12, "frame_number": 515, "display_filter": "frame.number == 515", "timestamp_epoch": "1582246434.271047000" }, { "udp_stream": 12, "frame_number": 593, "display_filter": "frame.number == 593", "timestamp_epoch": "1582246435.130059000" }, { "udp_stream": 12, "frame_number": 595, "display_filter": "frame.number == 595", "timestamp_epoch": "1582246435.849019000" }, { "udp_stream": 31, "frame_number": 601, "display_filter": "frame.number == 601", "timestamp_epoch": "1582246436.770479000" }, { "udp_stream": 31, "frame_number": 602, "display_filter": "frame.number == 602", "timestamp_epoch": "1582246437.457960000" }, { "udp_stream": 31, "frame_number": 603, "display_filter": "frame.number == 603", "timestamp_epoch": "1582246437.567971000" }, { "udp_stream": 31, "frame_number": 605, "display_filter": "frame.number == 605", "timestamp_epoch": "1582246438.208416000" }, { "udp_stream": 31, "frame_number": 607, "display_filter": "frame.number == 607", "timestamp_epoch": "1582246438.365100000" }, { "udp_stream": 31, "frame_number": 610, "display_filter": "frame.number == 610", "timestamp_epoch": "1582246439.020962000" }, { "udp_stream": 31, "frame_number": 611, "display_filter": "frame.number == 611", "timestamp_epoch": "1582246439.145311000" }, { "udp_stream": 31, "frame_number": 613, "display_filter": "frame.number == 613", "timestamp_epoch": "1582246439.802180000" }, { "udp_stream": 33, "frame_number": 616, "display_filter": "frame.number == 616", "timestamp_epoch": "1582246440.592958000" }, { "udp_stream": 33, "frame_number": 1791, "display_filter": "frame.number == 1791", "timestamp_epoch": "1582246678.029152000" }, { "udp_stream": 33, "frame_number": 2184, "display_filter": "frame.number == 2184", "timestamp_epoch": "1582247157.859759000" } ], "raw_values": [ "DESKTOP-TZMKHKC", "DESKTOP-TZMKHKC<00>,DESKTOP-TZMKHKC<00> (Workstation/Redirector)", "DESKTOP-TZMKHKC<20>,DESKTOP-TZMKHKC<20> (Server service)" ], "identity_id": "identity-cb05227f3e02993a6d02b2fe", "ip_addresses": [ "172.17.8.174" ], "mac_addresses": [ "00:11:75:8c:fd:47", "00:11:75:8c:fd:47,00:11:75:8c:fd:47" ] }, { "type": "netbios-group", "value": "ONE-HOT-MESS", "bindings": [ { "account": "", "owner_ip": null, "frame_number": 33, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": null, "frame_number": 513, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": null, "frame_number": 594, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.1", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": null, "frame_number": 600, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": null, "frame_number": 604, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": null, "frame_number": 606, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" }, { "account": "", "owner_ip": null, "frame_number": 612, "relationship": "group-membership-not-hostname", "source_field": "nbns.name", "conversation_dst": "172.17.8.255", "conversation_src": "172.17.8.174" } ], "evidence": [ { "udp_stream": 12, "frame_number": 33, "display_filter": "frame.number == 33", "timestamp_epoch": "1582246432.114189000" }, { "udp_stream": 12, "frame_number": 513, "display_filter": "frame.number == 513", "timestamp_epoch": "1582246433.612482000" }, { "udp_stream": 12, "frame_number": 594, "display_filter": "frame.number == 594", "timestamp_epoch": "1582246435.130251000" }, { "udp_stream": 31, "frame_number": 600, "display_filter": "frame.number == 600", "timestamp_epoch": "1582246436.770248000" }, { "udp_stream": 31, "frame_number": 604, "display_filter": "frame.number == 604", "timestamp_epoch": "1582246437.568171000" }, { "udp_stream": 31, "frame_number": 606, "display_filter": "frame.number == 606", "timestamp_epoch": "1582246438.364853000" }, { "udp_stream": 31, "frame_number": 612, "display_filter": "frame.number == 612", "timestamp_epoch": "1582246439.145404000" } ], "raw_values": [ "ONE-HOT-MESS<00>,ONE-HOT-MESS<00> (Workstation/Redirector)" ], "identity_id": "identity-85f1f87612dfe19c2c52b209", "ip_addresses": [], "mac_addresses": [] } ], "actor_leads": [], "observables": [ { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "2.tlu.dl.delivery.mp.microsoft.com", "evidence": [ { "udp_stream": 81, "frame_number": 5770, "display_filter": "frame.number == 5770", "timestamp_epoch": "1582247647.504799000" }, { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" }, { "tcp_stream": 135, "frame_number": 8989, "display_filter": "frame.number == 8989", "timestamp_epoch": "1582247651.642417000" }, { "tcp_stream": 136, "frame_number": 8991, "display_filter": "frame.number == 8991", "timestamp_epoch": "1582247651.642504000" }, { "tcp_stream": 136, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1582247651.737305000" } ], "is_private": null, "observable_id": "observable-c349b7dea7701eb5f08b8166", "last_seen_epoch": "1582247651.737305000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.504799000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "7.tlu.dl.delivery.mp.microsoft.com", "evidence": [ { "udp_stream": 83, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1582247651.264426000" }, { "udp_stream": 83, "frame_number": 8935, "display_filter": "frame.number == 8935", "timestamp_epoch": "1582247651.373628000" } ], "is_private": null, "observable_id": "observable-e6a1328fcbb2b3cba531392e", "last_seen_epoch": "1582247651.373628000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247651.264426000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "a-ring.msedge.net", "evidence": [ { "udp_stream": 74, "frame_number": 4666, "display_filter": "frame.number == 4666", "timestamp_epoch": "1582247513.709545000" }, { "udp_stream": 74, "frame_number": 4671, "display_filter": "frame.number == 4671", "timestamp_epoch": "1582247513.802766000" }, { "tcp_stream": 96, "frame_number": 4716, "display_filter": "frame.number == 4716", "timestamp_epoch": "1582247513.910345000" } ], "is_private": null, "observable_id": "observable-3bb5fa3eff5e90d80d21b02f", "last_seen_epoch": "1582247513.910345000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247513.709545000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "blueflag.xyz", "evidence": [ { "udp_stream": 49, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1582246506.138612000" }, { "udp_stream": 49, "frame_number": 1332, "display_filter": "frame.number == 1332", "timestamp_epoch": "1582246506.447128000" }, { "tcp_stream": 60, "frame_number": 1340, "display_filter": "frame.number == 1340", "timestamp_epoch": "1582246506.703102000" } ], "is_private": null, "observable_id": "observable-e398b99b7298c2051a7515bf", "last_seen_epoch": "1582246506.703102000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246506.138612000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "c-ring.msedge.net", "evidence": [ { "udp_stream": 44, "frame_number": 926, "display_filter": "frame.number == 926", "timestamp_epoch": "1582246456.627661000" }, { "udp_stream": 44, "frame_number": 931, "display_filter": "frame.number == 931", "timestamp_epoch": "1582246457.612994000" }, { "udp_stream": 44, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1582246457.808767000" }, { "tcp_stream": 49, "frame_number": 946, "display_filter": "frame.number == 946", "timestamp_epoch": "1582246457.920620000" } ], "is_private": null, "observable_id": "observable-2dd4da9939590bf47ce130a1", "last_seen_epoch": "1582246457.920620000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246456.627661000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "client.wns.windows.com", "evidence": [ { "udp_stream": 58, "frame_number": 1940, "display_filter": "frame.number == 1940", "timestamp_epoch": "1582246971.356190000" }, { "udp_stream": 58, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1582246971.561272000" }, { "udp_stream": 60, "frame_number": 2003, "display_filter": "frame.number == 2003", "timestamp_epoch": "1582247031.809220000" }, { "udp_stream": 60, "frame_number": 2008, "display_filter": "frame.number == 2008", "timestamp_epoch": "1582247032.420357000" }, { "tcp_stream": 76, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1582246971.714412000" }, { "tcp_stream": 77, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1582247032.579213000" } ], "is_private": null, "observable_id": "observable-d4f7606fe25c93bc00e9118f", "last_seen_epoch": "1582247032.579213000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246971.356190000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "config.edge.skype.com", "evidence": [ { "udp_stream": 69, "frame_number": 2318, "display_filter": "frame.number == 2318", "timestamp_epoch": "1582247353.836174000" }, { "udp_stream": 69, "frame_number": 2322, "display_filter": "frame.number == 2322", "timestamp_epoch": "1582247354.839056000" }, { "udp_stream": 69, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1582247355.849231000" }, { "udp_stream": 69, "frame_number": 3149, "display_filter": "frame.number == 3149", "timestamp_epoch": "1582247357.668186000" }, { "tcp_stream": 85, "frame_number": 3221, "display_filter": "frame.number == 3221", "timestamp_epoch": "1582247357.771214000" }, { "tcp_stream": 89, "frame_number": 3381, "display_filter": "frame.number == 3381", "timestamp_epoch": "1582247358.014663000" }, { "tcp_stream": 88, "frame_number": 3383, "display_filter": "frame.number == 3383", "timestamp_epoch": "1582247358.014928000" }, { "tcp_stream": 87, "frame_number": 3385, "display_filter": "frame.number == 3385", "timestamp_epoch": "1582247358.015171000" }, { "tcp_stream": 86, "frame_number": 3432, "display_filter": "frame.number == 3432", "timestamp_epoch": "1582247358.016098000" } ], "is_private": null, "observable_id": "observable-f246f830f03a9bac92c2ba70", "last_seen_epoch": "1582247358.016098000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247353.836174000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "cp601.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 78, "frame_number": 5684, "display_filter": "frame.number == 5684", "timestamp_epoch": "1582247646.578807000" }, { "udp_stream": 78, "frame_number": 5685, "display_filter": "frame.number == 5685", "timestamp_epoch": "1582247646.674447000" }, { "tcp_stream": 106, "frame_number": 5690, "display_filter": "frame.number == 5690", "timestamp_epoch": "1582247646.762451000" }, { "tcp_stream": 108, "frame_number": 5740, "display_filter": "frame.number == 5740", "timestamp_epoch": "1582247647.292513000" }, { "tcp_stream": 121, "frame_number": 5888, "display_filter": "frame.number == 5888", "timestamp_epoch": "1582247648.942106000" }, { "tcp_stream": 123, "frame_number": 6610, "display_filter": "frame.number == 6610", "timestamp_epoch": "1582247649.455036000" }, { "tcp_stream": 129, "frame_number": 8498, "display_filter": "frame.number == 8498", "timestamp_epoch": "1582247650.811535000" } ], "is_private": null, "observable_id": "observable-0075d192b861939e9f6b02cf", "last_seen_epoch": "1582247650.811535000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247646.578807000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "desktop-tzmkhkc.one-hot-mess.com", "evidence": [ { "udp_stream": 29, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1582246435.851831000" }, { "udp_stream": 29, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1582246435.852236000" }, { "udp_stream": 65, "frame_number": 2218, "display_filter": "frame.number == 2218", "timestamp_epoch": "1582247330.055127000" }, { "udp_stream": 65, "frame_number": 2220, "display_filter": "frame.number == 2220", "timestamp_epoch": "1582247330.055503000" } ], "is_private": null, "observable_id": "observable-e69367184c4e7a668b9deb14", "last_seen_epoch": "1582247330.055503000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246435.851831000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "dl.delivery.mp.microsoft.com", "evidence": [ { "udp_stream": 80, "frame_number": 5719, "display_filter": "frame.number == 5719", "timestamp_epoch": "1582247647.209505000" }, { "udp_stream": 80, "frame_number": 5742, "display_filter": "frame.number == 5742", "timestamp_epoch": "1582247647.303609000" }, { "tcp_stream": 109, "frame_number": 5753, "display_filter": "frame.number == 5753", "timestamp_epoch": "1582247647.389889000" }, { "tcp_stream": 122, "frame_number": 6576, "display_filter": "frame.number == 6576", "timestamp_epoch": "1582247649.446551000" }, { "tcp_stream": 126, "frame_number": 7409, "display_filter": "frame.number == 7409", "timestamp_epoch": "1582247649.954012000" }, { "tcp_stream": 130, "frame_number": 8927, "display_filter": "frame.number == 8927", "timestamp_epoch": "1582247651.329111000" } ], "is_private": null, "observable_id": "observable-842154a116009726355665e6", "last_seen_epoch": "1582247651.329111000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.209505000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "dns.msftncsi.com", "evidence": [ { "udp_stream": 9, "frame_number": 26, "display_filter": "frame.number == 26", "timestamp_epoch": "1582246431.364587000" }, { "udp_stream": 9, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1582246431.554751000" } ], "is_private": null, "observable_id": "observable-f218733a0a70e24df865caf3", "last_seen_epoch": "1582246431.554751000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246431.364587000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fe2cr.update.microsoft.com", "evidence": [ { "udp_stream": 61, "frame_number": 2035, "display_filter": "frame.number == 2035", "timestamp_epoch": "1582247034.747042000" }, { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" }, { "tcp_stream": 78, "frame_number": 2040, "display_filter": "frame.number == 2040", "timestamp_epoch": "1582247035.048224000" } ], "is_private": null, "observable_id": "observable-4e9abe268dc5b27b00f966bd", "last_seen_epoch": "1582247035.048224000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247034.747042000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "fe2cr.update.microsoft.com.akadns.net", "evidence": [ { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" } ], "is_private": null, "observable_id": "observable-3cc9006a45ba81f153483329", "last_seen_epoch": "1582247034.931427000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247034.931427000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fe3cr.delivery.mp.microsoft.com", "evidence": [ { "udp_stream": 62, "frame_number": 2121, "display_filter": "frame.number == 2121", "timestamp_epoch": "1582247036.930755000" }, { "udp_stream": 62, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1582247037.024283000" }, { "udp_stream": 68, "frame_number": 2249, "display_filter": "frame.number == 2249", "timestamp_epoch": "1582247333.882191000" }, { "udp_stream": 68, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1582247334.195082000" }, { "udp_stream": 79, "frame_number": 5687, "display_filter": "frame.number == 5687", "timestamp_epoch": "1582247646.687310000" }, { "udp_stream": 79, "frame_number": 5692, "display_filter": "frame.number == 5692", "timestamp_epoch": "1582247646.788647000" }, { "tcp_stream": 79, "frame_number": 2126, "display_filter": "frame.number == 2126", "timestamp_epoch": "1582247037.155452000" }, { "tcp_stream": 82, "frame_number": 2254, "display_filter": "frame.number == 2254", "timestamp_epoch": "1582247334.327265000" }, { "tcp_stream": 107, "frame_number": 5700, "display_filter": "frame.number == 5700", "timestamp_epoch": "1582247646.920312000" }, { "tcp_stream": 116, "frame_number": 5833, "display_filter": "frame.number == 5833", "timestamp_epoch": "1582247648.157623000" }, { "tcp_stream": 138, "frame_number": 9102, "display_filter": "frame.number == 9102", "timestamp_epoch": "1582247651.865502000" } ], "is_private": null, "observable_id": "observable-997b10cc201e2f00c72fbbfb", "last_seen_epoch": "1582247651.865502000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247036.930755000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp-vp.azureedge.net", "evidence": [ { "udp_stream": 73, "frame_number": 4540, "display_filter": "frame.number == 4540", "timestamp_epoch": "1582247512.934284000" }, { "udp_stream": 73, "frame_number": 4541, "display_filter": "frame.number == 4541", "timestamp_epoch": "1582247513.062427000" }, { "tcp_stream": 95, "frame_number": 4557, "display_filter": "frame.number == 4557", "timestamp_epoch": "1582247513.153657000" } ], "is_private": null, "observable_id": "observable-33de7a5adbe981f8b5184ad2", "last_seen_epoch": "1582247513.153657000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247512.934284000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "fp.msedge.net", "evidence": [ { "udp_stream": 72, "frame_number": 4436, "display_filter": "frame.number == 4436", "timestamp_epoch": "1582247509.660085000" }, { "udp_stream": 72, "frame_number": 4437, "display_filter": "frame.number == 4437", "timestamp_epoch": "1582247509.811440000" }, { "tcp_stream": 91, "frame_number": 4441, "display_filter": "frame.number == 4441", "timestamp_epoch": "1582247509.910153000" } ], "is_private": null, "observable_id": "observable-d4fe61ac00ef13a73068254f", "last_seen_epoch": "1582247509.910153000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247509.660085000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "geo.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 76, "frame_number": 5634, "display_filter": "frame.number == 5634", "timestamp_epoch": "1582247644.477120000" }, { "udp_stream": 76, "frame_number": 5635, "display_filter": "frame.number == 5635", "timestamp_epoch": "1582247644.559781000" }, { "tcp_stream": 104, "frame_number": 5639, "display_filter": "frame.number == 5639", "timestamp_epoch": "1582247644.789630000" } ], "is_private": null, "observable_id": "observable-7064ff870df471c261be7ee8", "last_seen_epoch": "1582247644.789630000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247644.477120000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "kv601.prod.do.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 77, "frame_number": 5658, "display_filter": "frame.number == 5658", "timestamp_epoch": "1582247645.910395000" }, { "udp_stream": 77, "frame_number": 5659, "display_filter": "frame.number == 5659", "timestamp_epoch": "1582247646.003943000" }, { "tcp_stream": 105, "frame_number": 5663, "display_filter": "frame.number == 5663", "timestamp_epoch": "1582247646.082972000" } ], "is_private": null, "observable_id": "observable-e23c94b5a225dafc7d7c6c6c", "last_seen_epoch": "1582247646.082972000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247645.910395000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "login.microsoftonline.com", "evidence": [ { "udp_stream": 45, "frame_number": 1179, "display_filter": "frame.number == 1179", "timestamp_epoch": "1582246464.057685000" }, { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" }, { "tcp_stream": 56, "frame_number": 1188, "display_filter": "frame.number == 1188", "timestamp_epoch": "1582246464.628719000" } ], "is_private": null, "observable_id": "observable-19d710883d074b712e06d19c", "last_seen_epoch": "1582246464.628719000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.057685000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "mrodevicemgr.officeapps.live.com", "evidence": [ { "udp_stream": 70, "frame_number": 2319, "display_filter": "frame.number == 2319", "timestamp_epoch": "1582247354.647613000" }, { "udp_stream": 70, "frame_number": 2320, "display_filter": "frame.number == 2320", "timestamp_epoch": "1582247354.748161000" }, { "tcp_stream": 83, "frame_number": 2325, "display_filter": "frame.number == 2325", "timestamp_epoch": "1582247354.882140000" } ], "is_private": null, "observable_id": "observable-4caeed826ff17cc5f3d2ee16", "last_seen_epoch": "1582247354.882140000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247354.647613000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "nexusrules.officeapps.live.com", "evidence": [ { "udp_stream": 56, "frame_number": 1741, "display_filter": "frame.number == 1741", "timestamp_epoch": "1582246584.660763000" }, { "udp_stream": 56, "frame_number": 1744, "display_filter": "frame.number == 1744", "timestamp_epoch": "1582246584.856481000" }, { "tcp_stream": 68, "frame_number": 1748, "display_filter": "frame.number == 1748", "timestamp_epoch": "1582246585.130250000" } ], "is_private": null, "observable_id": "observable-10556fc0804ab0fbe3417c21", "last_seen_epoch": "1582246585.130250000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246584.660763000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "officecdn.microsoft.com", "evidence": [ { "udp_stream": 71, "frame_number": 2351, "display_filter": "frame.number == 2351", "timestamp_epoch": "1582247355.766165000" }, { "udp_stream": 71, "frame_number": 2353, "display_filter": "frame.number == 2353", "timestamp_epoch": "1582247355.864518000" }, { "tcp_stream": 84, "frame_number": 2357, "display_filter": "frame.number == 2357", "timestamp_epoch": "1582247355.986585000" } ], "is_private": null, "observable_id": "observable-cfeb22aa1594a7b22fad8960", "last_seen_epoch": "1582247355.986585000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247355.766165000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "one-hot-mess-dc.one-hot-mess.com", "evidence": [ { "udp_stream": 5, "frame_number": 11, "display_filter": "frame.number == 11", "timestamp_epoch": "1582246431.141151000" }, { "udp_stream": 5, "frame_number": 12, "display_filter": "frame.number == 12", "timestamp_epoch": "1582246431.141527000" }, { "udp_stream": 26, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1582246432.718664000" }, { "udp_stream": 26, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1582246432.718966000" } ], "is_private": null, "observable_id": "observable-fecda50588903bb943517377", "last_seen_epoch": "1582246432.718966000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246431.141151000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "one-hot-mess.com", "evidence": [ { "udp_stream": 30, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1582246435.853954000" }, { "udp_stream": 30, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1582246435.855180000" }, { "udp_stream": 66, "frame_number": 2222, "display_filter": "frame.number == 2222", "timestamp_epoch": "1582247330.056588000" }, { "udp_stream": 66, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1582247330.057439000" } ], "is_private": null, "observable_id": "observable-a94b2b32b7223853b50e152c", "last_seen_epoch": "1582247330.057439000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246435.853954000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "one-hot-mess.net", "evidence": [ { "udp_stream": 40, "frame_number": 773, "display_filter": "frame.number == 773", "timestamp_epoch": "1582246452.179610000" }, { "udp_stream": 40, "frame_number": 774, "display_filter": "frame.number == 774", "timestamp_epoch": "1582246452.179824000" } ], "is_private": null, "observable_id": "observable-1810e0467b541bfdd2bab449", "last_seen_epoch": "1582246452.179824000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246452.179610000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "ow1.res.office365.com", "evidence": [ { "udp_stream": 43, "frame_number": 923, "display_filter": "frame.number == 923", "timestamp_epoch": "1582246456.602562000" }, { "udp_stream": 43, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1582246457.597218000" }, { "udp_stream": 43, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1582246457.808708000" }, { "tcp_stream": 48, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1582246457.925669000" } ], "is_private": null, "observable_id": "observable-2637add9a016aa48bbf03342", "last_seen_epoch": "1582246457.925669000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246456.602562000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.mrodevicemgr.live.com.akadns.net", "evidence": [ { "udp_stream": 70, "frame_number": 2320, "display_filter": "frame.number == 2320", "timestamp_epoch": "1582247354.748161000" } ], "is_private": null, "observable_id": "observable-b53690dd705070db4bd396e2", "last_seen_epoch": "1582247354.748161000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247354.748161000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "prod.nexusrules.live.com.akadns.net", "evidence": [ { "udp_stream": 56, "frame_number": 1744, "display_filter": "frame.number == 1744", "timestamp_epoch": "1582246584.856481000" } ], "is_private": null, "observable_id": "observable-ea56484321f7343708de83a5", "last_seen_epoch": "1582246584.856481000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246584.856481000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "pti.store.microsoft.com", "evidence": [ { "udp_stream": 59, "frame_number": 1941, "display_filter": "frame.number == 1941", "timestamp_epoch": "1582246971.395342000" }, { "udp_stream": 59, "frame_number": 1942, "display_filter": "frame.number == 1942", "timestamp_epoch": "1582246971.491797000" }, { "tcp_stream": 75, "frame_number": 1948, "display_filter": "frame.number == 1948", "timestamp_epoch": "1582246971.593434000" } ], "is_private": null, "observable_id": "observable-99789dea42e0a12771b7e662", "last_seen_epoch": "1582246971.593434000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246971.395342000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "s-0001.s-msedge.net", "evidence": [ { "udp_stream": 69, "frame_number": 3149, "display_filter": "frame.number == 3149", "timestamp_epoch": "1582247357.668186000" } ], "is_private": null, "observable_id": "observable-8edb1f6f5d7b9c4c02b3759c", "last_seen_epoch": "1582247357.668186000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247357.668186000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "s-ring.msedge.net", "evidence": [ { "udp_stream": 42, "frame_number": 922, "display_filter": "frame.number == 922", "timestamp_epoch": "1582246456.548808000" }, { "udp_stream": 42, "frame_number": 928, "display_filter": "frame.number == 928", "timestamp_epoch": "1582246457.550518000" }, { "udp_stream": 42, "frame_number": 1020, "display_filter": "frame.number == 1020", "timestamp_epoch": "1582246458.550528000" }, { "udp_stream": 42, "frame_number": 1034, "display_filter": "frame.number == 1034", "timestamp_epoch": "1582246460.567597000" }, { "udp_stream": 42, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1582246460.902826000" }, { "tcp_stream": 50, "frame_number": 1043, "display_filter": "frame.number == 1043", "timestamp_epoch": "1582246461.020773000" }, { "tcp_stream": 94, "frame_number": 4513, "display_filter": "frame.number == 4513", "timestamp_epoch": "1582247512.351164000" } ], "is_private": null, "observable_id": "observable-b4da2ce053f7692753009c17", "last_seen_epoch": "1582247512.351164000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246456.548808000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "self.events.data.microsoft.com", "evidence": [ { "udp_stream": 36, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1582246442.929497000" }, { "udp_stream": 36, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1582246443.041084000" }, { "udp_stream": 48, "frame_number": 1233, "display_filter": "frame.number == 1233", "timestamp_epoch": "1582246473.838979000" }, { "udp_stream": 48, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1582246474.059399000" }, { "udp_stream": 52, "frame_number": 1570, "display_filter": "frame.number == 1570", "timestamp_epoch": "1582246512.594997000" }, { "udp_stream": 52, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1582246512.742109000" }, { "tcp_stream": 34, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1582246443.186153000" }, { "tcp_stream": 58, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1582246474.230432000" }, { "tcp_stream": 61, "frame_number": 1579, "display_filter": "frame.number == 1579", "timestamp_epoch": "1582246513.012628000" }, { "tcp_stream": 73, "frame_number": 1876, "display_filter": "frame.number == 1876", "timestamp_epoch": "1582246763.360785000" }, { "tcp_stream": 74, "frame_number": 1909, "display_filter": "frame.number == 1909", "timestamp_epoch": "1582246869.204521000" }, { "tcp_stream": 80, "frame_number": 2188, "display_filter": "frame.number == 2188", "timestamp_epoch": "1582247183.152269000" } ], "is_private": null, "observable_id": "observable-6e87a09466622f08a1aa83d3", "last_seen_epoch": "1582247183.152269000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246442.929497000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "self.events.data.onecollector.akadns.net", "evidence": [ { "udp_stream": 48, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1582246474.059399000" }, { "udp_stream": 52, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1582246512.742109000" } ], "is_private": null, "observable_id": "observable-5950a205ba083e4957a60d11", "last_seen_epoch": "1582246512.742109000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246474.059399000" }, { "type": "domain", "roles": [ "dns-query", "http-host" ], "value": "tlu.dl.delivery.mp.microsoft.com", "evidence": [ { "udp_stream": 82, "frame_number": 5779, "display_filter": "frame.number == 5779", "timestamp_epoch": "1582247647.604485000" }, { "udp_stream": 82, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1582247647.697828000" }, { "tcp_stream": 114, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1582247647.791570000" }, { "tcp_stream": 115, "frame_number": 5806, "display_filter": "frame.number == 5806", "timestamp_epoch": "1582247647.791739000" }, { "tcp_stream": 112, "frame_number": 5808, "display_filter": "frame.number == 5808", "timestamp_epoch": "1582247647.791889000" }, { "tcp_stream": 113, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1582247647.792050000" }, { "tcp_stream": 117, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1582247648.842040000" }, { "tcp_stream": 118, "frame_number": 5880, "display_filter": "frame.number == 5880", "timestamp_epoch": "1582247648.853066000" }, { "tcp_stream": 119, "frame_number": 5882, "display_filter": "frame.number == 5882", "timestamp_epoch": "1582247648.853312000" }, { "tcp_stream": 120, "frame_number": 5884, "display_filter": "frame.number == 5884", "timestamp_epoch": "1582247648.853546000" }, { "tcp_stream": 120, "frame_number": 5894, "display_filter": "frame.number == 5894", "timestamp_epoch": "1582247648.964297000" }, { "tcp_stream": 117, "frame_number": 5896, "display_filter": "frame.number == 5896", "timestamp_epoch": "1582247648.974578000" }, { "tcp_stream": 124, "frame_number": 7066, "display_filter": "frame.number == 7066", "timestamp_epoch": "1582247649.678232000" }, { "tcp_stream": 125, "frame_number": 7069, "display_filter": "frame.number == 7069", "timestamp_epoch": "1582247649.678457000" }, { "tcp_stream": 125, "frame_number": 7398, "display_filter": "frame.number == 7398", "timestamp_epoch": "1582247649.844921000" }, { "tcp_stream": 128, "frame_number": 7710, "display_filter": "frame.number == 7710", "timestamp_epoch": "1582247650.216638000" }, { "tcp_stream": 127, "frame_number": 7720, "display_filter": "frame.number == 7720", "timestamp_epoch": "1582247650.216920000" }, { "tcp_stream": 128, "frame_number": 7969, "display_filter": "frame.number == 7969", "timestamp_epoch": "1582247650.353753000" }, { "tcp_stream": 131, "frame_number": 8949, "display_filter": "frame.number == 8949", "timestamp_epoch": "1582247651.480063000" }, { "tcp_stream": 132, "frame_number": 8951, "display_filter": "frame.number == 8951", "timestamp_epoch": "1582247651.480147000" } ], "is_private": null, "observable_id": "observable-6d098c50ae4766831ba53c1e", "last_seen_epoch": "1582247651.700292000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.604485000" }, { "type": "domain", "roles": [ "dns-cname" ], "value": "tsfe.trafficmanager.net", "evidence": [ { "udp_stream": 75, "frame_number": 5526, "display_filter": "frame.number == 5526", "timestamp_epoch": "1582247641.965800000" } ], "is_private": null, "observable_id": "observable-ef21cb9dd7e52b1293d730e8", "last_seen_epoch": "1582247641.965800000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247641.965800000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "tsfe.trafficshaping.dsp.mp.microsoft.com", "evidence": [ { "udp_stream": 75, "frame_number": 5523, "display_filter": "frame.number == 5523", "timestamp_epoch": "1582247640.723717000" }, { "udp_stream": 75, "frame_number": 5524, "display_filter": "frame.number == 5524", "timestamp_epoch": "1582247640.931841000" }, { "udp_stream": 75, "frame_number": 5525, "display_filter": "frame.number == 5525", "timestamp_epoch": "1582247641.962233000" }, { "udp_stream": 75, "frame_number": 5526, "display_filter": "frame.number == 5526", "timestamp_epoch": "1582247641.965800000" }, { "tcp_stream": 101, "frame_number": 5530, "display_filter": "frame.number == 5530", "timestamp_epoch": "1582247642.109241000" }, { "tcp_stream": 102, "frame_number": 5562, "display_filter": "frame.number == 5562", "timestamp_epoch": "1582247642.888828000" }, { "tcp_stream": 103, "frame_number": 5599, "display_filter": "frame.number == 5599", "timestamp_epoch": "1582247643.679977000" } ], "is_private": null, "observable_id": "observable-910aa7f3a44c175b9b909a54", "last_seen_epoch": "1582247643.679977000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247640.723717000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.localdomain", "evidence": [ { "udp_stream": 11, "frame_number": 29, "display_filter": "frame.number == 29", "timestamp_epoch": "1582246431.541544000" }, { "udp_stream": 11, "frame_number": 30, "display_filter": "frame.number == 30", "timestamp_epoch": "1582246431.541833000" }, { "udp_stream": 38, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1582246446.555212000" }, { "udp_stream": 38, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1582246446.555436000" }, { "udp_stream": 51, "frame_number": 1336, "display_filter": "frame.number == 1336", "timestamp_epoch": "1582246506.556761000" }, { "udp_stream": 51, "frame_number": 1337, "display_filter": "frame.number == 1337", "timestamp_epoch": "1582246506.556980000" }, { "udp_stream": 64, "frame_number": 2177, "display_filter": "frame.number == 2177", "timestamp_epoch": "1582247106.569997000" }, { "udp_stream": 64, "frame_number": 2178, "display_filter": "frame.number == 2178", "timestamp_epoch": "1582247106.570166000" } ], "is_private": null, "observable_id": "observable-9238c00a570c5784f4afc154", "last_seen_epoch": "1582247106.570166000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246431.541544000" }, { "type": "domain", "roles": [ "dns-query" ], "value": "wpad.one-hot-mess.com", "evidence": [ { "udp_stream": 10, "frame_number": 27, "display_filter": "frame.number == 27", "timestamp_epoch": "1582246431.534875000" }, { "udp_stream": 10, "frame_number": 28, "display_filter": "frame.number == 28", "timestamp_epoch": "1582246431.535139000" }, { "udp_stream": 37, "frame_number": 709, "display_filter": "frame.number == 709", "timestamp_epoch": "1582246446.554333000" }, { "udp_stream": 37, "frame_number": 710, "display_filter": "frame.number == 710", "timestamp_epoch": "1582246446.554749000" }, { "udp_stream": 50, "frame_number": 1334, "display_filter": "frame.number == 1334", "timestamp_epoch": "1582246506.555990000" }, { "udp_stream": 50, "frame_number": 1335, "display_filter": "frame.number == 1335", "timestamp_epoch": "1582246506.556316000" }, { "udp_stream": 63, "frame_number": 2175, "display_filter": "frame.number == 2175", "timestamp_epoch": "1582247106.569307000" }, { "udp_stream": 63, "frame_number": 2176, "display_filter": "frame.number == 2176", "timestamp_epoch": "1582247106.569609000" } ], "is_private": null, "observable_id": "observable-4271ff0e774baf8098d1012c", "last_seen_epoch": "1582247106.569609000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246431.534875000" }, { "type": "domain", "roles": [ "dns-query", "tls-sni" ], "value": "www.bing.com", "evidence": [ { "udp_stream": 41, "frame_number": 921, "display_filter": "frame.number == 921", "timestamp_epoch": "1582246456.491647000" }, { "udp_stream": 41, "frame_number": 924, "display_filter": "frame.number == 924", "timestamp_epoch": "1582246456.608292000" }, { "udp_stream": 55, "frame_number": 1708, "display_filter": "frame.number == 1708", "timestamp_epoch": "1582246560.531193000" }, { "udp_stream": 55, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1582246560.676996000" }, { "tcp_stream": 46, "frame_number": 940, "display_filter": "frame.number == 940", "timestamp_epoch": "1582246457.813124000" }, { "tcp_stream": 47, "frame_number": 941, "display_filter": "frame.number == 941", "timestamp_epoch": "1582246457.813278000" }, { "tcp_stream": 51, "frame_number": 1065, "display_filter": "frame.number == 1065", "timestamp_epoch": "1582246462.267652000" }, { "tcp_stream": 67, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1582246560.763316000" }, { "tcp_stream": 92, "frame_number": 4472, "display_filter": "frame.number == 4472", "timestamp_epoch": "1582247510.448404000" } ], "is_private": null, "observable_id": "observable-44a03c82ff1877983cebe8f0", "last_seen_epoch": "1582247510.448404000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246456.491647000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "0.0.0.0", "evidence": [], "is_private": true, "observable_id": "observable-4125f35b52d185232a9f910d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "104.77.69.193", "evidence": [ { "udp_stream": 77, "frame_number": 5659, "display_filter": "frame.number == 5659", "timestamp_epoch": "1582247646.003943000" }, { "udp_stream": 78, "frame_number": 5685, "display_filter": "frame.number == 5685", "timestamp_epoch": "1582247646.674447000" } ], "is_private": false, "observable_id": "observable-9352bf4fffe94bacc5819799", "last_seen_epoch": "1582247646.674447000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247646.003943000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "13.107.21.200", "evidence": [ { "udp_stream": 41, "frame_number": 924, "display_filter": "frame.number == 924", "timestamp_epoch": "1582246456.608292000" }, { "udp_stream": 55, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1582246560.676996000" } ], "is_private": false, "observable_id": "observable-4929c8a4d34403a327b2b277", "last_seen_epoch": "1582246560.676996000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246456.608292000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.246.10", "evidence": [ { "udp_stream": 59, "frame_number": 1942, "display_filter": "frame.number == 1942", "timestamp_epoch": "1582246971.491797000" } ], "is_private": false, "observable_id": "observable-bbba987cdc38be71ecfe574e", "last_seen_epoch": "1582246971.491797000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246971.491797000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.3.128", "evidence": [ { "udp_stream": 69, "frame_number": 3149, "display_filter": "frame.number == 3149", "timestamp_epoch": "1582247357.668186000" } ], "is_private": false, "observable_id": "observable-193b9306e08a81574d06fc22", "last_seen_epoch": "1582247357.668186000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247357.668186000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.3.254", "evidence": [ { "udp_stream": 42, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1582246460.902826000" } ], "is_private": false, "observable_id": "observable-b4bef3ae5467e7802293ded1", "last_seen_epoch": "1582246460.902826000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246460.902826000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.4.254", "evidence": [ { "udp_stream": 44, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1582246457.808767000" } ], "is_private": false, "observable_id": "observable-0bd65b245da76298a22864a4", "last_seen_epoch": "1582246457.808767000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246457.808767000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "13.107.4.50", "evidence": [ { "udp_stream": 80, "frame_number": 5742, "display_filter": "frame.number == 5742", "timestamp_epoch": "1582247647.303609000" }, { "udp_stream": 83, "frame_number": 8935, "display_filter": "frame.number == 8935", "timestamp_epoch": "1582247651.373628000" } ], "is_private": false, "observable_id": "observable-aa07c8df19a0668173d8f158", "last_seen_epoch": "1582247651.373628000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.303609000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "131.107.255.255", "evidence": [ { "udp_stream": 9, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1582246431.554751000" } ], "is_private": false, "observable_id": "observable-904029c2f9e4d5ff36db75c9", "last_seen_epoch": "1582246431.554751000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246431.554751000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "172.17.8.1", "evidence": [], "is_private": true, "observable_id": "observable-4358d5257db250713ba330d9", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.17.8.174", "evidence": [ { "udp_stream": 30, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1582246435.853954000" }, { "udp_stream": 30, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1582246435.855180000" }, { "udp_stream": 66, "frame_number": 2222, "display_filter": "frame.number == 2222", "timestamp_epoch": "1582247330.056588000" }, { "udp_stream": 66, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1582247330.057439000" } ], "is_private": true, "observable_id": "observable-76c9ace0a30f9b0b3794bbd7", "last_seen_epoch": "1582247330.057439000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246435.853954000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "172.17.8.255", "evidence": [], "is_private": true, "observable_id": "observable-3f61019bd397b15ae9bc1c93", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "172.17.8.8", "evidence": [ { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1582246431.132004000" }, { "udp_stream": 5, "frame_number": 12, "display_filter": "frame.number == 12", "timestamp_epoch": "1582246431.141527000" }, { "udp_stream": 14, "frame_number": 37, "display_filter": "frame.number == 37", "timestamp_epoch": "1582246432.227512000" }, { "udp_stream": 17, "frame_number": 43, "display_filter": "frame.number == 43", "timestamp_epoch": "1582246432.289581000" }, { "udp_stream": 20, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1582246432.419998000" }, { "udp_stream": 22, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1582246432.537530000" }, { "udp_stream": 24, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1582246432.653831000" }, { "udp_stream": 26, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1582246432.718966000" }, { "udp_stream": 27, "frame_number": 517, "display_filter": "frame.number == 517", "timestamp_epoch": "1582246434.315645000" }, { "udp_stream": 29, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1582246435.852236000" }, { "udp_stream": 40, "frame_number": 774, "display_filter": "frame.number == 774", "timestamp_epoch": "1582246452.179824000" }, { "udp_stream": 46, "frame_number": 1183, "display_filter": "frame.number == 1183", "timestamp_epoch": "1582246464.533342000" }, { "udp_stream": 53, "frame_number": 1574, "display_filter": "frame.number == 1574", "timestamp_epoch": "1582246512.935824000" }, { "udp_stream": 52, "frame_number": 1799, "display_filter": "frame.number == 1799", "timestamp_epoch": "1582246733.394985000" }, { "udp_stream": 65, "frame_number": 2220, "display_filter": "frame.number == 2220", "timestamp_epoch": "1582247330.055503000" } ], "is_private": true, "observable_id": "observable-45730801868d0c1bca799c98", "last_seen_epoch": "1582247330.055503000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246431.132004000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "20.190.133.66", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-f5d91350ab7d99359843dbc4", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "20.190.133.75", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-da57a8a5cf10cf0786ec6638", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "20.190.133.76", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-def5ac5511ceb7e5f1723b23", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.200", "evidence": [ { "udp_stream": 41, "frame_number": 924, "display_filter": "frame.number == 924", "timestamp_epoch": "1582246456.608292000" }, { "udp_stream": 55, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1582246560.676996000" } ], "is_private": false, "observable_id": "observable-db7a8d09200d61729719e21f", "last_seen_epoch": "1582246560.676996000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246456.608292000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.222", "evidence": [ { "udp_stream": 72, "frame_number": 4437, "display_filter": "frame.number == 4437", "timestamp_epoch": "1582247509.811440000" } ], "is_private": false, "observable_id": "observable-9a793667f8f456714999a1e6", "last_seen_epoch": "1582247509.811440000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247509.811440000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "204.79.197.254", "evidence": [ { "udp_stream": 74, "frame_number": 4671, "display_filter": "frame.number == 4671", "timestamp_epoch": "1582247513.802766000" } ], "is_private": false, "observable_id": "observable-f10db5ad2b4dad781f9e4af1", "last_seen_epoch": "1582247513.802766000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247513.802766000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.185.216.10", "evidence": [ { "udp_stream": 82, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1582247647.697828000" } ], "is_private": false, "observable_id": "observable-7cb42e06f57adff2b355999b", "last_seen_epoch": "1582247647.697828000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.697828000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "205.185.216.42", "evidence": [ { "udp_stream": 82, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1582247647.697828000" } ], "is_private": false, "observable_id": "observable-3650f0f11b426cb85e8d35a3", "last_seen_epoch": "1582247647.697828000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.697828000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.22", "evidence": [], "is_private": false, "observable_id": "observable-27b9228142a8b975fb22bd6d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.251", "evidence": [], "is_private": false, "observable_id": "observable-022fc7fb74e9122329896b5a", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "224.0.0.252", "evidence": [], "is_private": false, "observable_id": "observable-c51231e7c28dcab5e47dab25", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.1.236.100", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-6f634acb0e243309e77ccb39", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.1.236.107", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-76e09a0250c504de6d4373aa", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.1.236.114", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-f8f71e1113d06ff1e40410f5", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.1.236.125", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-4687948311eb6140068d450d", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.1.236.74", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-5fa364954c9aa79e75044ff3", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.1.236.75", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-dd5bc71e4f4dcbe832582f91", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.1.236.85", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-f1f0600b822b1bd6764ad67a", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.1.236.92", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-97584b7141b6c19d191acf3b", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "23.1.236.98", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "is_private": false, "observable_id": "observable-402fa74cceafefcf90ada8c5", "last_seen_epoch": "1582247647.592563000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.592563000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.20.119", "evidence": [ { "udp_stream": 71, "frame_number": 2353, "display_filter": "frame.number == 2353", "timestamp_epoch": "1582247355.864518000" } ], "is_private": false, "observable_id": "observable-70847d8cc76c81ae595d944a", "last_seen_epoch": "1582247355.864518000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247355.864518000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "23.54.20.139", "evidence": [ { "udp_stream": 43, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1582246457.808708000" } ], "is_private": false, "observable_id": "observable-7c2732937ce38f94655360b9", "last_seen_epoch": "1582246457.808708000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246457.808708000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "255.255.255.255", "evidence": [], "is_private": true, "observable_id": "observable-5dc8cd10f69503dde9045a47", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.5.100", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-d4e283c6b3ea69f4a49665ee", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.126.5.35", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-14e6e7c3947eaa6d8bb2c6fd", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.5.37", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-5e10218ceb5e86eb215637b2", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.5.98", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-046c703f882eaf67b9bc98ed", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.126.5.99", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "is_private": false, "observable_id": "observable-426148b5f0ee6ec9595ce209", "last_seen_epoch": "1582246464.271335000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246464.271335000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.69.216.73", "evidence": [ { "udp_stream": 76, "frame_number": 5635, "display_filter": "frame.number == 5635", "timestamp_epoch": "1582247644.559781000" } ], "is_private": false, "observable_id": "observable-f1fc3cfd7e86d772338a2ddf", "last_seen_epoch": "1582247644.559781000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247644.559781000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "40.91.116.226", "evidence": [ { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" } ], "is_private": false, "observable_id": "observable-1c0d3bab70aac371b74597dd", "last_seen_epoch": "1582247034.931427000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247034.931427000" }, { "type": "ipv4", "roles": [ "dns-answer" ], "value": "40.91.120.196", "evidence": [ { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" } ], "is_private": false, "observable_id": "observable-5263069858ff29b11f523688", "last_seen_epoch": "1582247034.931427000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247034.931427000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "49.51.172.56", "evidence": [ { "udp_stream": 49, "frame_number": 1332, "display_filter": "frame.number == 1332", "timestamp_epoch": "1582246506.447128000" } ], "is_private": false, "observable_id": "observable-4e2c5d25c852e9d17ce17b95", "last_seen_epoch": "1582246506.447128000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246506.447128000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.109.124.20", "evidence": [ { "udp_stream": 56, "frame_number": 1744, "display_filter": "frame.number == 1744", "timestamp_epoch": "1582246584.856481000" } ], "is_private": false, "observable_id": "observable-5a1306761a23e2137dac2e29", "last_seen_epoch": "1582246584.856481000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246584.856481000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.109.2.55", "evidence": [ { "udp_stream": 70, "frame_number": 2320, "display_filter": "frame.number == 2320", "timestamp_epoch": "1582247354.748161000" } ], "is_private": false, "observable_id": "observable-afc88ce283c22562e8d1279c", "last_seen_epoch": "1582247354.748161000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247354.748161000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.128.9", "evidence": [ { "udp_stream": 48, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1582246474.059399000" } ], "is_private": false, "observable_id": "observable-d3c67a9441beb89e20e85500", "last_seen_epoch": "1582246474.059399000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246474.059399000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.132.22", "evidence": [ { "udp_stream": 36, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1582246443.041084000" } ], "is_private": false, "observable_id": "observable-3de2ef556760130793de8b99", "last_seen_epoch": "1582246443.041084000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246443.041084000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.114.76.34", "evidence": [ { "udp_stream": 52, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1582246512.742109000" } ], "is_private": false, "observable_id": "observable-a1b2bf7acdb85461ddd4e318", "last_seen_epoch": "1582246512.742109000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246512.742109000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.159.17.76", "evidence": [ { "udp_stream": 75, "frame_number": 5526, "display_filter": "frame.number == 5526", "timestamp_epoch": "1582247641.965800000" } ], "is_private": false, "observable_id": "observable-48f337dfe26d08829c3b46de", "last_seen_epoch": "1582247641.965800000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247641.965800000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "52.230.222.68", "evidence": [ { "udp_stream": 58, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1582246971.561272000" }, { "udp_stream": 60, "frame_number": 2008, "display_filter": "frame.number == 2008", "timestamp_epoch": "1582247032.420357000" } ], "is_private": false, "observable_id": "observable-832b20af9d2129f3f00a68c5", "last_seen_epoch": "1582247032.420357000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246971.561272000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "64.4.54.18", "evidence": [ { "udp_stream": 62, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1582247037.024283000" }, { "udp_stream": 68, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1582247334.195082000" }, { "udp_stream": 79, "frame_number": 5692, "display_filter": "frame.number == 5692", "timestamp_epoch": "1582247646.788647000" } ], "is_private": false, "observable_id": "observable-ce72b62e190eaf310460deaf", "last_seen_epoch": "1582247646.788647000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247037.024283000" }, { "type": "ipv4", "roles": [ "dns-answer", "network-endpoint" ], "value": "72.21.81.200", "evidence": [ { "udp_stream": 73, "frame_number": 4541, "display_filter": "frame.number == 4541", "timestamp_epoch": "1582247513.062427000" } ], "is_private": false, "observable_id": "observable-f4e673c99a1067c26977c12d", "last_seen_epoch": "1582247513.062427000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247513.062427000" }, { "type": "ipv4", "roles": [ "network-endpoint" ], "value": "91.211.88.122", "evidence": [], "is_private": false, "observable_id": "observable-ef5bbf89cf708c774c6a436d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "28a2c9bd18a11de089ef85a160da29e4", "evidence": [ { "tcp_stream": 68, "frame_number": 1748, "display_filter": "frame.number == 1748", "timestamp_epoch": "1582246585.130250000" }, { "tcp_stream": 75, "frame_number": 1948, "display_filter": "frame.number == 1948", "timestamp_epoch": "1582246971.593434000" }, { "tcp_stream": 78, "frame_number": 2040, "display_filter": "frame.number == 2040", "timestamp_epoch": "1582247035.048224000" }, { "tcp_stream": 79, "frame_number": 2126, "display_filter": "frame.number == 2126", "timestamp_epoch": "1582247037.155452000" }, { "tcp_stream": 82, "frame_number": 2254, "display_filter": "frame.number == 2254", "timestamp_epoch": "1582247334.327265000" }, { "tcp_stream": 101, "frame_number": 5530, "display_filter": "frame.number == 5530", "timestamp_epoch": "1582247642.109241000" }, { "tcp_stream": 102, "frame_number": 5562, "display_filter": "frame.number == 5562", "timestamp_epoch": "1582247642.888828000" }, { "tcp_stream": 103, "frame_number": 5599, "display_filter": "frame.number == 5599", "timestamp_epoch": "1582247643.679977000" }, { "tcp_stream": 104, "frame_number": 5639, "display_filter": "frame.number == 5639", "timestamp_epoch": "1582247644.789630000" }, { "tcp_stream": 105, "frame_number": 5663, "display_filter": "frame.number == 5663", "timestamp_epoch": "1582247646.082972000" }, { "tcp_stream": 106, "frame_number": 5690, "display_filter": "frame.number == 5690", "timestamp_epoch": "1582247646.762451000" }, { "tcp_stream": 107, "frame_number": 5700, "display_filter": "frame.number == 5700", "timestamp_epoch": "1582247646.920312000" }, { "tcp_stream": 108, "frame_number": 5740, "display_filter": "frame.number == 5740", "timestamp_epoch": "1582247647.292513000" }, { "tcp_stream": 116, "frame_number": 5833, "display_filter": "frame.number == 5833", "timestamp_epoch": "1582247648.157623000" }, { "tcp_stream": 121, "frame_number": 5888, "display_filter": "frame.number == 5888", "timestamp_epoch": "1582247648.942106000" }, { "tcp_stream": 123, "frame_number": 6610, "display_filter": "frame.number == 6610", "timestamp_epoch": "1582247649.455036000" }, { "tcp_stream": 129, "frame_number": 8498, "display_filter": "frame.number == 8498", "timestamp_epoch": "1582247650.811535000" }, { "tcp_stream": 138, "frame_number": 9102, "display_filter": "frame.number == 9102", "timestamp_epoch": "1582247651.865502000" } ], "is_private": null, "observable_id": "observable-660711f8c4d7dc8b3ab66204", "last_seen_epoch": "1582247651.865502000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246585.130250000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "37f463bf4616ecd445d4a1937da06e19", "evidence": [ { "tcp_stream": 58, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1582246474.230432000" }, { "tcp_stream": 61, "frame_number": 1579, "display_filter": "frame.number == 1579", "timestamp_epoch": "1582246513.012628000" }, { "tcp_stream": 74, "frame_number": 1909, "display_filter": "frame.number == 1909", "timestamp_epoch": "1582246869.204521000" }, { "tcp_stream": 80, "frame_number": 2188, "display_filter": "frame.number == 2188", "timestamp_epoch": "1582247183.152269000" } ], "is_private": null, "observable_id": "observable-fe774759a8e91f6acb50066c", "last_seen_epoch": "1582247183.152269000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246474.230432000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "3b5074b1b5d032e5620f69f9f700ff0e", "evidence": [ { "tcp_stream": 76, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1582246971.714412000" }, { "tcp_stream": 77, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1582247032.579213000" } ], "is_private": null, "observable_id": "observable-dcce696975c8749358b57386", "last_seen_epoch": "1582247032.579213000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246971.714412000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "51c64c77e60f3980eea90869b68c58a8", "evidence": [ { "tcp_stream": 90, "frame_number": 4422, "display_filter": "frame.number == 4422", "timestamp_epoch": "1582247508.600095000" }, { "tcp_stream": 93, "frame_number": 4500, "display_filter": "frame.number == 4500", "timestamp_epoch": "1582247511.654130000" }, { "tcp_stream": 97, "frame_number": 5435, "display_filter": "frame.number == 5435", "timestamp_epoch": "1582247516.365288000" }, { "tcp_stream": 100, "frame_number": 5478, "display_filter": "frame.number == 5478", "timestamp_epoch": "1582247523.123786000" } ], "is_private": null, "observable_id": "observable-67c1cd2796fa136dd58c5d60", "last_seen_epoch": "1582247523.123786000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247508.600095000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "9e10692f1b7f78228b2d4e424db3a98c", "evidence": [ { "tcp_stream": 46, "frame_number": 940, "display_filter": "frame.number == 940", "timestamp_epoch": "1582246457.813124000" }, { "tcp_stream": 47, "frame_number": 941, "display_filter": "frame.number == 941", "timestamp_epoch": "1582246457.813278000" }, { "tcp_stream": 49, "frame_number": 946, "display_filter": "frame.number == 946", "timestamp_epoch": "1582246457.920620000" }, { "tcp_stream": 48, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1582246457.925669000" }, { "tcp_stream": 50, "frame_number": 1043, "display_filter": "frame.number == 1043", "timestamp_epoch": "1582246461.020773000" }, { "tcp_stream": 51, "frame_number": 1065, "display_filter": "frame.number == 1065", "timestamp_epoch": "1582246462.267652000" }, { "tcp_stream": 56, "frame_number": 1188, "display_filter": "frame.number == 1188", "timestamp_epoch": "1582246464.628719000" }, { "tcp_stream": 67, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1582246560.763316000" }, { "tcp_stream": 91, "frame_number": 4441, "display_filter": "frame.number == 4441", "timestamp_epoch": "1582247509.910153000" }, { "tcp_stream": 92, "frame_number": 4472, "display_filter": "frame.number == 4472", "timestamp_epoch": "1582247510.448404000" }, { "tcp_stream": 94, "frame_number": 4513, "display_filter": "frame.number == 4513", "timestamp_epoch": "1582247512.351164000" }, { "tcp_stream": 95, "frame_number": 4557, "display_filter": "frame.number == 4557", "timestamp_epoch": "1582247513.153657000" }, { "tcp_stream": 96, "frame_number": 4716, "display_filter": "frame.number == 4716", "timestamp_epoch": "1582247513.910345000" } ], "is_private": null, "observable_id": "observable-2577882d72e071347c4b5d66", "last_seen_epoch": "1582247513.910345000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246457.813124000" }, { "type": "ja3", "roles": [ "tls-client-fingerprint" ], "value": "a0e9f5d64349fb13191bc781f81f42e1", "evidence": [ { "tcp_stream": 34, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1582246443.186153000" }, { "tcp_stream": 73, "frame_number": 1876, "display_filter": "frame.number == 1876", "timestamp_epoch": "1582246763.360785000" }, { "tcp_stream": 83, "frame_number": 2325, "display_filter": "frame.number == 2325", "timestamp_epoch": "1582247354.882140000" }, { "tcp_stream": 84, "frame_number": 2357, "display_filter": "frame.number == 2357", "timestamp_epoch": "1582247355.986585000" }, { "tcp_stream": 85, "frame_number": 3221, "display_filter": "frame.number == 3221", "timestamp_epoch": "1582247357.771214000" }, { "tcp_stream": 89, "frame_number": 3381, "display_filter": "frame.number == 3381", "timestamp_epoch": "1582247358.014663000" }, { "tcp_stream": 88, "frame_number": 3383, "display_filter": "frame.number == 3383", "timestamp_epoch": "1582247358.014928000" }, { "tcp_stream": 87, "frame_number": 3385, "display_filter": "frame.number == 3385", "timestamp_epoch": "1582247358.015171000" }, { "tcp_stream": 86, "frame_number": 3432, "display_filter": "frame.number == 3432", "timestamp_epoch": "1582247358.016098000" } ], "is_private": null, "observable_id": "observable-162f1518cf6c79ae7056aa1f", "last_seen_epoch": "1582247358.016098000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246443.186153000" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066", "evidence": [], "is_private": null, "observable_id": "observable-68d84fd3015161cf881a1bb5", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e", "evidence": [], "is_private": null, "observable_id": "observable-79699e175e249cfc0d23e7e2", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78", "evidence": [], "is_private": null, "observable_id": "observable-a5dcf8ccc13bc8ff59e9b580", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc", "evidence": [], "is_private": null, "observable_id": "observable-d3e4a48491ef54d9fa85f133", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48", "evidence": [], "is_private": null, "observable_id": "observable-b9078d2c4dc1d8b381a51ddf", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86", "evidence": [], "is_private": null, "observable_id": "observable-e1a13b36dc940a2fe9250f7f", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961", "evidence": [], "is_private": null, "observable_id": "observable-b95c47a89d6c6febed11a33d", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0", "evidence": [], "is_private": null, "observable_id": "observable-68570bec3cb57d8b37c4cf2b", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513", "evidence": [], "is_private": null, "observable_id": "observable-84c9046e70a6ffc825aca018", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "sha256", "roles": [ "exported-object" ], "value": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "evidence": [], "is_private": null, "observable_id": "observable-00bfcccdb142ab388a02f7a4", "last_seen_epoch": "", "enrichment_state": "not_requested", "first_seen_epoch": "" }, { "type": "url", "roles": [ "http-request" ], "value": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "evidence": [ { "tcp_stream": 135, "frame_number": 8989, "display_filter": "frame.number == 8989", "timestamp_epoch": "1582247651.642417000" }, { "tcp_stream": 136, "frame_number": 8991, "display_filter": "frame.number == 8991", "timestamp_epoch": "1582247651.642504000" }, { "tcp_stream": 136, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1582247651.737305000" } ], "is_private": null, "observable_id": "observable-1cf2ea0faa9fbdc19cd5ee7f", "last_seen_epoch": "1582247651.737305000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247651.642417000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://blueflag.xyz/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin", "evidence": [ { "tcp_stream": 60, "frame_number": 1340, "display_filter": "frame.number == 1340", "timestamp_epoch": "1582246506.703102000" } ], "is_private": null, "observable_id": "observable-c7d302d4c29b1dd4b501ce9a", "last_seen_epoch": "1582246506.703102000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246506.703102000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash", "evidence": [ { "tcp_stream": 109, "frame_number": 5753, "display_filter": "frame.number == 5753", "timestamp_epoch": "1582247647.389889000" } ], "is_private": null, "observable_id": "observable-a58d13f25df672cb14813249", "last_seen_epoch": "1582247647.389889000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.389889000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash", "evidence": [ { "tcp_stream": 130, "frame_number": 8927, "display_filter": "frame.number == 8927", "timestamp_epoch": "1582247651.329111000" } ], "is_private": null, "observable_id": "observable-0aa3f2224acb1140b4c8d9ea", "last_seen_epoch": "1582247651.329111000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247651.329111000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash", "evidence": [ { "tcp_stream": 126, "frame_number": 7409, "display_filter": "frame.number == 7409", "timestamp_epoch": "1582247649.954012000" } ], "is_private": null, "observable_id": "observable-63e133730afba2a4a0cc44d3", "last_seen_epoch": "1582247649.954012000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247649.954012000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash", "evidence": [ { "tcp_stream": 122, "frame_number": 6576, "display_filter": "frame.number == 6576", "timestamp_epoch": "1582247649.446551000" } ], "is_private": null, "observable_id": "observable-c5d9a386662f53a603df7d18", "last_seen_epoch": "1582247649.446551000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247649.446551000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d", "evidence": [ { "tcp_stream": 112, "frame_number": 5808, "display_filter": "frame.number == 5808", "timestamp_epoch": "1582247647.791889000" }, { "tcp_stream": 113, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1582247647.792050000" } ], "is_private": null, "observable_id": "observable-c687310dfc5c012006a2c9a0", "last_seen_epoch": "1582247647.792050000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.791889000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "evidence": [ { "tcp_stream": 119, "frame_number": 5882, "display_filter": "frame.number == 5882", "timestamp_epoch": "1582247648.853312000" }, { "tcp_stream": 120, "frame_number": 5884, "display_filter": "frame.number == 5884", "timestamp_epoch": "1582247648.853546000" }, { "tcp_stream": 120, "frame_number": 5894, "display_filter": "frame.number == 5894", "timestamp_epoch": "1582247648.964297000" } ], "is_private": null, "observable_id": "observable-08d0722a24a8048eb57d3526", "last_seen_epoch": "1582247648.964297000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247648.853312000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d", "evidence": [ { "tcp_stream": 114, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1582247647.791570000" }, { "tcp_stream": 115, "frame_number": 5806, "display_filter": "frame.number == 5806", "timestamp_epoch": "1582247647.791739000" } ], "is_private": null, "observable_id": "observable-4c3d9e027c6a5abf2157a5e9", "last_seen_epoch": "1582247647.791739000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.791570000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "evidence": [ { "tcp_stream": 117, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1582247648.842040000" }, { "tcp_stream": 118, "frame_number": 5880, "display_filter": "frame.number == 5880", "timestamp_epoch": "1582247648.853066000" }, { "tcp_stream": 117, "frame_number": 5896, "display_filter": "frame.number == 5896", "timestamp_epoch": "1582247648.974578000" } ], "is_private": null, "observable_id": "observable-18e10eeaeb2272968ccaebfd", "last_seen_epoch": "1582247648.974578000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247648.842040000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d", "evidence": [ { "tcp_stream": 133, "frame_number": 8959, "display_filter": "frame.number == 8959", "timestamp_epoch": "1582247651.530518000" }, { "tcp_stream": 134, "frame_number": 8961, "display_filter": "frame.number == 8961", "timestamp_epoch": "1582247651.530634000" } ], "is_private": null, "observable_id": "observable-3fb13ac1ebb51cc8e4a4c67c", "last_seen_epoch": "1582247651.530634000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247651.530518000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "evidence": [ { "tcp_stream": 128, "frame_number": 7710, "display_filter": "frame.number == 7710", "timestamp_epoch": "1582247650.216638000" }, { "tcp_stream": 127, "frame_number": 7720, "display_filter": "frame.number == 7720", "timestamp_epoch": "1582247650.216920000" }, { "tcp_stream": 128, "frame_number": 7969, "display_filter": "frame.number == 7969", "timestamp_epoch": "1582247650.353753000" }, { "tcp_stream": 131, "frame_number": 8949, "display_filter": "frame.number == 8949", "timestamp_epoch": "1582247651.480063000" }, { "tcp_stream": 132, "frame_number": 8951, "display_filter": "frame.number == 8951", "timestamp_epoch": "1582247651.480147000" }, { "tcp_stream": 137, "frame_number": 8999, "display_filter": "frame.number == 8999", "timestamp_epoch": "1582247651.700292000" } ], "is_private": null, "observable_id": "observable-97d0b6d9d4409deb9c13868c", "last_seen_epoch": "1582247651.700292000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247650.216638000" }, { "type": "url", "roles": [ "http-request" ], "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "evidence": [ { "tcp_stream": 124, "frame_number": 7066, "display_filter": "frame.number == 7066", "timestamp_epoch": "1582247649.678232000" }, { "tcp_stream": 125, "frame_number": 7069, "display_filter": "frame.number == 7069", "timestamp_epoch": "1582247649.678457000" }, { "tcp_stream": 125, "frame_number": 7398, "display_filter": "frame.number == 7398", "timestamp_epoch": "1582247649.844921000" } ], "is_private": null, "observable_id": "observable-75a37deaeb8d7ab197a02c6d", "last_seen_epoch": "1582247649.844921000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247649.678232000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Microsoft-Delivery-Optimization/10.0", "evidence": [ { "tcp_stream": 109, "frame_number": 5753, "display_filter": "frame.number == 5753", "timestamp_epoch": "1582247647.389889000" }, { "tcp_stream": 114, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1582247647.791570000" }, { "tcp_stream": 115, "frame_number": 5806, "display_filter": "frame.number == 5806", "timestamp_epoch": "1582247647.791739000" }, { "tcp_stream": 112, "frame_number": 5808, "display_filter": "frame.number == 5808", "timestamp_epoch": "1582247647.791889000" }, { "tcp_stream": 113, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1582247647.792050000" }, { "tcp_stream": 117, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1582247648.842040000" }, { "tcp_stream": 118, "frame_number": 5880, "display_filter": "frame.number == 5880", "timestamp_epoch": "1582247648.853066000" }, { "tcp_stream": 119, "frame_number": 5882, "display_filter": "frame.number == 5882", "timestamp_epoch": "1582247648.853312000" }, { "tcp_stream": 120, "frame_number": 5884, "display_filter": "frame.number == 5884", "timestamp_epoch": "1582247648.853546000" }, { "tcp_stream": 120, "frame_number": 5894, "display_filter": "frame.number == 5894", "timestamp_epoch": "1582247648.964297000" }, { "tcp_stream": 117, "frame_number": 5896, "display_filter": "frame.number == 5896", "timestamp_epoch": "1582247648.974578000" }, { "tcp_stream": 122, "frame_number": 6576, "display_filter": "frame.number == 6576", "timestamp_epoch": "1582247649.446551000" }, { "tcp_stream": 124, "frame_number": 7066, "display_filter": "frame.number == 7066", "timestamp_epoch": "1582247649.678232000" }, { "tcp_stream": 125, "frame_number": 7069, "display_filter": "frame.number == 7069", "timestamp_epoch": "1582247649.678457000" }, { "tcp_stream": 125, "frame_number": 7398, "display_filter": "frame.number == 7398", "timestamp_epoch": "1582247649.844921000" }, { "tcp_stream": 126, "frame_number": 7409, "display_filter": "frame.number == 7409", "timestamp_epoch": "1582247649.954012000" }, { "tcp_stream": 128, "frame_number": 7710, "display_filter": "frame.number == 7710", "timestamp_epoch": "1582247650.216638000" }, { "tcp_stream": 127, "frame_number": 7720, "display_filter": "frame.number == 7720", "timestamp_epoch": "1582247650.216920000" }, { "tcp_stream": 128, "frame_number": 7969, "display_filter": "frame.number == 7969", "timestamp_epoch": "1582247650.353753000" }, { "tcp_stream": 130, "frame_number": 8927, "display_filter": "frame.number == 8927", "timestamp_epoch": "1582247651.329111000" } ], "is_private": null, "observable_id": "observable-94f3e3fdf5f8fff92e256d0c", "last_seen_epoch": "1582247651.737305000", "enrichment_state": "not_requested", "first_seen_epoch": "1582247647.389889000" }, { "type": "user_agent", "roles": [ "http-client" ], "value": "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)", "evidence": [ { "tcp_stream": 60, "frame_number": 1340, "display_filter": "frame.number == 1340", "timestamp_epoch": "1582246506.703102000" } ], "is_private": null, "observable_id": "observable-cb1992f072de1b5135f78fce", "last_seen_epoch": "1582246506.703102000", "enrichment_state": "not_requested", "first_seen_epoch": "1582246506.703102000" } ], "schema_version": "pcap-analysis-v1", "semantic_sha256": "6fc7d6e1a73357c382b6269858c45faf638a8c9f52816c64ae733c965cb7611b", "analyzer_manifest": { "limits": { "max_flows": 50000, "max_endpoints": 20000, "max_upload_bytes": 536870912, "max_exported_files": 50000, "max_events_per_kind": 50000, "max_exported_objects": 500, "tool_timeout_seconds": 300, "max_object_hash_index": 50000, "max_tool_output_bytes": 268435456, "max_exported_total_bytes": 268435456, "max_exported_object_bytes": 52428800 }, "profile_id": "tshark-evidence-v6", "profile_sha256": "aff64bf3786902d5d7a2c1a9be158a5246cc81aecea6c44eda74701431070465", "schema_version": "pcap-analyzer-manifest-v1", "tshark_version": "TShark (Wireshark) 4.4.18.", "manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0", "capinfos_version": "Capinfos (Wireshark) 4.4.18.", "rulepack_version": "pcap-rules-v5", "implementation_sha256": "1a7d19199ff58059a12b34656620481b502fadc52d115b5f4b42fc28e5817c3c", "requested_fields_sha256": "e7a6eff11f7ae2101845897ce7e3b0a0e9cea31bdea4a824734869f39f3fb4f3", "supported_profile_fields_sha256": "6d94b9bc3aea93d5f7f4f815bdd025560ceba0d5e27b380ad14da28b44947994" }, "attack_candidates": [], "analysis_key_material": { "source_sha256": "8b984eca8fb96799a9ad7ec5ee766937e640dc1afcad77101e5aeb0ba6be137d", "rulepack_version": "pcap-rules-v5", "analyzer_manifest_sha256": "1f3c02483cfea06d85bd326f6e225f3f41a4ab703677d40537577e8bb85c1ce0" } }, "context": { "mode": "local-only", "matches": [], "coverage": { "truncated": false, "no_exact_match": 125, "observable_limit": 5000, "observables_total": 125, "matched_observables": 0, "observables_checked": 125, "prior_cases_checked": 50, "prior_case_limit_reached": true }, "created_at": "2026-09-22T16:01:29.660633+00:00", "session_id": "04f135b9-8158-47a2-bfef-d6de028c53c4", "techniques": [], "interpretation": "No match means unknown in this corpus. Local CTI may postdate the capture. Matches and shared infrastructure require review; no automatic promotion or attribution.", "schema_version": "pcap-context-v1", "snapshot_sha256": "6a03461060569af0c77daab88ab63819de6e1c6487437f55da1aa05dadc3739f", "source_actor_links": [], "external_enrichment": { "reason": "Requires explicit provider consent and privacy review", "status": "not-requested", "requests": 0 }, "source_semantic_sha256": "6fc7d6e1a73357c382b6269858c45faf638a8c9f52816c64ae733c965cb7611b", "cross_case_correlations": [ { "shared_count": 35, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 19, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 22, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 13, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 14, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 18, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 24, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 18, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 26, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 29, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 2, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 7, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 12, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 11, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 24, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 25, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 10, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 26, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 15, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 16, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." }, { "shared_count": 8, "status": "shared-observation-not-common-campaign", "public_note": "Prior-session identifiers and detailed shared values omitted; aggregate overlap is not attribution." } ] }, "assessment": { "policy_version": "pcap-assessment-v3", "source_semantic_sha256": "6fc7d6e1a73357c382b6269858c45faf638a8c9f52816c64ae733c965cb7611b", "items": [ { "observable_id": "observable-c349b7dea7701eb5f08b8166", "type": "domain", "value": "2.tlu.dl.delivery.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.573554+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.392883+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.389787+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5770, "display_filter": "frame.number == 5770", "timestamp_epoch": "1582247647.504799000" }, { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" }, { "tcp_stream": 135, "frame_number": 8989, "display_filter": "frame.number == 8989", "timestamp_epoch": "1582247651.642417000" }, { "tcp_stream": 136, "frame_number": 8991, "display_filter": "frame.number == 8991", "timestamp_epoch": "1582247651.642504000" }, { "tcp_stream": 136, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1582247651.737305000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.386150+00:00" }, { "observable_id": "observable-e6a1328fcbb2b3cba531392e", "type": "domain", "value": "7.tlu.dl.delivery.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:28.336130+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.333599+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 83, "frame_number": 8924, "display_filter": "frame.number == 8924", "timestamp_epoch": "1582247651.264426000" }, { "udp_stream": 83, "frame_number": 8935, "display_filter": "frame.number == 8935", "timestamp_epoch": "1582247651.373628000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:28.330971+00:00" }, { "observable_id": "observable-3bb5fa3eff5e90d80d21b02f", "type": "domain", "value": "a-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.581095+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:09.908536+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.576223+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 4666, "display_filter": "frame.number == 4666", "timestamp_epoch": "1582247513.709545000" }, { "udp_stream": 74, "frame_number": 4671, "display_filter": "frame.number == 4671", "timestamp_epoch": "1582247513.802766000" }, { "tcp_stream": 96, "frame_number": 4716, "display_filter": "frame.number == 4716", "timestamp_epoch": "1582247513.910345000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.573598+00:00" }, { "observable_id": "observable-e398b99b7298c2051a7515bf", "type": "domain", "value": "blueflag.xyz", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.036146+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:23.864167+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.862341+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 1331, "display_filter": "frame.number == 1331", "timestamp_epoch": "1582246506.138612000" }, { "udp_stream": 49, "frame_number": 1332, "display_filter": "frame.number == 1332", "timestamp_epoch": "1582246506.447128000" }, { "tcp_stream": 60, "frame_number": 1340, "display_filter": "frame.number == 1340", "timestamp_epoch": "1582246506.703102000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:23.860278+00:00" }, { "observable_id": "observable-2dd4da9939590bf47ce130a1", "type": "domain", "value": "c-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.587859+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:44:57.151553+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.583410+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 926, "display_filter": "frame.number == 926", "timestamp_epoch": "1582246456.627661000" }, { "udp_stream": 44, "frame_number": 931, "display_filter": "frame.number == 931", "timestamp_epoch": "1582246457.612994000" }, { "udp_stream": 44, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1582246457.808767000" }, { "tcp_stream": 49, "frame_number": 946, "display_filter": "frame.number == 946", "timestamp_epoch": "1582246457.920620000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.581128+00:00" }, { "observable_id": "observable-d4f7606fe25c93bc00e9118f", "type": "domain", "value": "client.wns.windows.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.593714+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:12.580326+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.589794+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 1940, "display_filter": "frame.number == 1940", "timestamp_epoch": "1582246971.356190000" }, { "udp_stream": 58, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1582246971.561272000" }, { "udp_stream": 60, "frame_number": 2003, "display_filter": "frame.number == 2003", "timestamp_epoch": "1582247031.809220000" }, { "udp_stream": 60, "frame_number": 2008, "display_filter": "frame.number == 2008", "timestamp_epoch": "1582247032.420357000" }, { "tcp_stream": 76, "frame_number": 1960, "display_filter": "frame.number == 1960", "timestamp_epoch": "1582246971.714412000" }, { "tcp_stream": 77, "frame_number": 2012, "display_filter": "frame.number == 2012", "timestamp_epoch": "1582247032.579213000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.587898+00:00" }, { "observable_id": "observable-f246f830f03a9bac92c2ba70", "type": "domain", "value": "config.edge.skype.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:13.482784+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.682958+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 2318, "display_filter": "frame.number == 2318", "timestamp_epoch": "1582247353.836174000" }, { "udp_stream": 69, "frame_number": 2322, "display_filter": "frame.number == 2322", "timestamp_epoch": "1582247354.839056000" }, { "udp_stream": 69, "frame_number": 2352, "display_filter": "frame.number == 2352", "timestamp_epoch": "1582247355.849231000" }, { "udp_stream": 69, "frame_number": 3149, "display_filter": "frame.number == 3149", "timestamp_epoch": "1582247357.668186000" }, { "tcp_stream": 85, "frame_number": 3221, "display_filter": "frame.number == 3221", "timestamp_epoch": "1582247357.771214000" }, { "tcp_stream": 89, "frame_number": 3381, "display_filter": "frame.number == 3381", "timestamp_epoch": "1582247358.014663000" }, { "tcp_stream": 88, "frame_number": 3383, "display_filter": "frame.number == 3383", "timestamp_epoch": "1582247358.014928000" }, { "tcp_stream": 87, "frame_number": 3385, "display_filter": "frame.number == 3385", "timestamp_epoch": "1582247358.015171000" }, { "tcp_stream": 86, "frame_number": 3432, "display_filter": "frame.number == 3432", "timestamp_epoch": "1582247358.016098000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.679877+00:00" }, { "observable_id": "observable-0075d192b861939e9f6b02cf", "type": "domain", "value": "cp601.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.689443+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.687713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 78, "frame_number": 5684, "display_filter": "frame.number == 5684", "timestamp_epoch": "1582247646.578807000" }, { "udp_stream": 78, "frame_number": 5685, "display_filter": "frame.number == 5685", "timestamp_epoch": "1582247646.674447000" }, { "tcp_stream": 106, "frame_number": 5690, "display_filter": "frame.number == 5690", "timestamp_epoch": "1582247646.762451000" }, { "tcp_stream": 108, "frame_number": 5740, "display_filter": "frame.number == 5740", "timestamp_epoch": "1582247647.292513000" }, { "tcp_stream": 121, "frame_number": 5888, "display_filter": "frame.number == 5888", "timestamp_epoch": "1582247648.942106000" }, { "tcp_stream": 123, "frame_number": 6610, "display_filter": "frame.number == 6610", "timestamp_epoch": "1582247649.455036000" }, { "tcp_stream": 129, "frame_number": 8498, "display_filter": "frame.number == 8498", "timestamp_epoch": "1582247650.811535000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.685442+00:00" }, { "observable_id": "observable-e69367184c4e7a668b9deb14", "type": "domain", "value": "desktop-tzmkhkc.one-hot-mess.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:28.621090+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.618037+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 29, "frame_number": 596, "display_filter": "frame.number == 596", "timestamp_epoch": "1582246435.851831000" }, { "udp_stream": 29, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1582246435.852236000" }, { "udp_stream": 65, "frame_number": 2218, "display_filter": "frame.number == 2218", "timestamp_epoch": "1582247330.055127000" }, { "udp_stream": 65, "frame_number": 2220, "display_filter": "frame.number == 2220", "timestamp_epoch": "1582247330.055503000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:28.614002+00:00" }, { "observable_id": "observable-842154a116009726355665e6", "type": "domain", "value": "dl.delivery.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:25.862793+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.860235+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 5719, "display_filter": "frame.number == 5719", "timestamp_epoch": "1582247647.209505000" }, { "udp_stream": 80, "frame_number": 5742, "display_filter": "frame.number == 5742", "timestamp_epoch": "1582247647.303609000" }, { "tcp_stream": 109, "frame_number": 5753, "display_filter": "frame.number == 5753", "timestamp_epoch": "1582247647.389889000" }, { "tcp_stream": 122, "frame_number": 6576, "display_filter": "frame.number == 6576", "timestamp_epoch": "1582247649.446551000" }, { "tcp_stream": 126, "frame_number": 7409, "display_filter": "frame.number == 7409", "timestamp_epoch": "1582247649.954012000" }, { "tcp_stream": 130, "frame_number": 8927, "display_filter": "frame.number == 8927", "timestamp_epoch": "1582247651.329111000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:25.856751+00:00" }, { "observable_id": "observable-f218733a0a70e24df865caf3", "type": "domain", "value": "dns.msftncsi.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 9, "frame_number": 26, "display_filter": "frame.number == 26", "timestamp_epoch": "1582246431.364587000" }, { "udp_stream": 9, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1582246431.554751000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e9abe268dc5b27b00f966bd", "type": "domain", "value": "fe2cr.update.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:18.790645+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.048028+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 2035, "display_filter": "frame.number == 2035", "timestamp_epoch": "1582247034.747042000" }, { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" }, { "tcp_stream": 78, "frame_number": 2040, "display_filter": "frame.number == 2040", "timestamp_epoch": "1582247035.048224000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.041316+00:00" }, { "observable_id": "observable-3cc9006a45ba81f153483329", "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-997b10cc201e2f00c72fbbfb", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:18.983978+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.063224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 2121, "display_filter": "frame.number == 2121", "timestamp_epoch": "1582247036.930755000" }, { "udp_stream": 62, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1582247037.024283000" }, { "udp_stream": 68, "frame_number": 2249, "display_filter": "frame.number == 2249", "timestamp_epoch": "1582247333.882191000" }, { "udp_stream": 68, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1582247334.195082000" }, { "udp_stream": 79, "frame_number": 5687, "display_filter": "frame.number == 5687", "timestamp_epoch": "1582247646.687310000" }, { "udp_stream": 79, "frame_number": 5692, "display_filter": "frame.number == 5692", "timestamp_epoch": "1582247646.788647000" }, { "tcp_stream": 79, "frame_number": 2126, "display_filter": "frame.number == 2126", "timestamp_epoch": "1582247037.155452000" }, { "tcp_stream": 82, "frame_number": 2254, "display_filter": "frame.number == 2254", "timestamp_epoch": "1582247334.327265000" }, { "tcp_stream": 107, "frame_number": 5700, "display_filter": "frame.number == 5700", "timestamp_epoch": "1582247646.920312000" }, { "tcp_stream": 116, "frame_number": 5833, "display_filter": "frame.number == 5833", "timestamp_epoch": "1582247648.157623000" }, { "tcp_stream": 138, "frame_number": 9102, "display_filter": "frame.number == 9102", "timestamp_epoch": "1582247651.865502000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.056103+00:00" }, { "observable_id": "observable-33de7a5adbe981f8b5184ad2", "type": "domain", "value": "fp-vp.azureedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:20.879395+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.076990+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 4540, "display_filter": "frame.number == 4540", "timestamp_epoch": "1582247512.934284000" }, { "udp_stream": 73, "frame_number": 4541, "display_filter": "frame.number == 4541", "timestamp_epoch": "1582247513.062427000" }, { "tcp_stream": 95, "frame_number": 4557, "display_filter": "frame.number == 4557", "timestamp_epoch": "1582247513.153657000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.071418+00:00" }, { "observable_id": "observable-d4fe61ac00ef13a73068254f", "type": "domain", "value": "fp.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:21.666722+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.090920+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 4436, "display_filter": "frame.number == 4436", "timestamp_epoch": "1582247509.660085000" }, { "udp_stream": 72, "frame_number": 4437, "display_filter": "frame.number == 4437", "timestamp_epoch": "1582247509.811440000" }, { "tcp_stream": 91, "frame_number": 4441, "display_filter": "frame.number == 4441", "timestamp_epoch": "1582247509.910153000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.083733+00:00" }, { "observable_id": "observable-7064ff870df471c261be7ee8", "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": true, "queried_at": "2026-09-22T17:45:21.871597+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.105307+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 5634, "display_filter": "frame.number == 5634", "timestamp_epoch": "1582247644.477120000" }, { "udp_stream": 76, "frame_number": 5635, "display_filter": "frame.number == 5635", "timestamp_epoch": "1582247644.559781000" }, { "tcp_stream": 104, "frame_number": 5639, "display_filter": "frame.number == 5639", "timestamp_epoch": "1582247644.789630000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.097214+00:00" }, { "observable_id": "observable-e23c94b5a225dafc7d7c6c6c", "type": "domain", "value": "kv601.prod.do.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:26.122331+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.117068+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 5658, "display_filter": "frame.number == 5658", "timestamp_epoch": "1582247645.910395000" }, { "udp_stream": 77, "frame_number": 5659, "display_filter": "frame.number == 5659", "timestamp_epoch": "1582247646.003943000" }, { "tcp_stream": 105, "frame_number": 5663, "display_filter": "frame.number == 5663", "timestamp_epoch": "1582247646.082972000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.111369+00:00" }, { "observable_id": "observable-19d710883d074b712e06d19c", "type": "domain", "value": "login.microsoftonline.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:26.312021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.306753+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1179, "display_filter": "frame.number == 1179", "timestamp_epoch": "1582246464.057685000" }, { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" }, { "tcp_stream": 56, "frame_number": 1188, "display_filter": "frame.number == 1188", "timestamp_epoch": "1582246464.628719000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.301669+00:00" }, { "observable_id": "observable-4caeed826ff17cc5f3d2ee16", "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:26.666120+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.660910+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 2319, "display_filter": "frame.number == 2319", "timestamp_epoch": "1582247354.647613000" }, { "udp_stream": 70, "frame_number": 2320, "display_filter": "frame.number == 2320", "timestamp_epoch": "1582247354.748161000" }, { "tcp_stream": 83, "frame_number": 2325, "display_filter": "frame.number == 2325", "timestamp_epoch": "1582247354.882140000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.654458+00:00" }, { "observable_id": "observable-10556fc0804ab0fbe3417c21", "type": "domain", "value": "nexusrules.officeapps.live.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:26.851269+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.844190+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 1741, "display_filter": "frame.number == 1741", "timestamp_epoch": "1582246584.660763000" }, { "udp_stream": 56, "frame_number": 1744, "display_filter": "frame.number == 1744", "timestamp_epoch": "1582246584.856481000" }, { "tcp_stream": 68, "frame_number": 1748, "display_filter": "frame.number == 1748", "timestamp_epoch": "1582246585.130250000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:26.838274+00:00" }, { "observable_id": "observable-cfeb22aa1594a7b22fad8960", "type": "domain", "value": "officecdn.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:27.067622+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.059660+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 2351, "display_filter": "frame.number == 2351", "timestamp_epoch": "1582247355.766165000" }, { "udp_stream": 71, "frame_number": 2353, "display_filter": "frame.number == 2353", "timestamp_epoch": "1582247355.864518000" }, { "tcp_stream": 84, "frame_number": 2357, "display_filter": "frame.number == 2357", "timestamp_epoch": "1582247355.986585000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:27.049820+00:00" }, { "observable_id": "observable-fecda50588903bb943517377", "type": "domain", "value": "one-hot-mess-dc.one-hot-mess.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:28.798305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.796217+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 5, "frame_number": 11, "display_filter": "frame.number == 11", "timestamp_epoch": "1582246431.141151000" }, { "udp_stream": 5, "frame_number": 12, "display_filter": "frame.number == 12", "timestamp_epoch": "1582246431.141527000" }, { "udp_stream": 26, "frame_number": 301, "display_filter": "frame.number == 301", "timestamp_epoch": "1582246432.718664000" }, { "udp_stream": 26, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1582246432.718966000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:28.793539+00:00" }, { "observable_id": "observable-a94b2b32b7223853b50e152c", "type": "domain", "value": "one-hot-mess.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:29.064922+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.060709+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1582246435.853954000" }, { "udp_stream": 30, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1582246435.855180000" }, { "udp_stream": 66, "frame_number": 2222, "display_filter": "frame.number == 2222", "timestamp_epoch": "1582247330.056588000" }, { "udp_stream": 66, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1582247330.057439000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:29.055901+00:00" }, { "observable_id": "observable-1810e0467b541bfdd2bab449", "type": "domain", "value": "one-hot-mess.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:29.245822+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.243806+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 40, "frame_number": 773, "display_filter": "frame.number == 773", "timestamp_epoch": "1582246452.179610000" }, { "udp_stream": 40, "frame_number": 774, "display_filter": "frame.number == 774", "timestamp_epoch": "1582246452.179824000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:29.241636+00:00" }, { "observable_id": "observable-2637add9a016aa48bbf03342", "type": "domain", "value": "ow1.res.office365.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:27.254704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.252079+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 923, "display_filter": "frame.number == 923", "timestamp_epoch": "1582246456.602562000" }, { "udp_stream": 43, "frame_number": 929, "display_filter": "frame.number == 929", "timestamp_epoch": "1582246457.597218000" }, { "udp_stream": 43, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1582246457.808708000" }, { "tcp_stream": 48, "frame_number": 950, "display_filter": "frame.number == 950", "timestamp_epoch": "1582246457.925669000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:27.248546+00:00" }, { "observable_id": "observable-b53690dd705070db4bd396e2", "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 2320, "display_filter": "frame.number == 2320", "timestamp_epoch": "1582247354.748161000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-ea56484321f7343708de83a5", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 1744, "display_filter": "frame.number == 1744", "timestamp_epoch": "1582246584.856481000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-99789dea42e0a12771b7e662", "type": "domain", "value": "pti.store.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:27.440552+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.438140+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 1941, "display_filter": "frame.number == 1941", "timestamp_epoch": "1582246971.395342000" }, { "udp_stream": 59, "frame_number": 1942, "display_filter": "frame.number == 1942", "timestamp_epoch": "1582246971.491797000" }, { "tcp_stream": 75, "frame_number": 1948, "display_filter": "frame.number == 1948", "timestamp_epoch": "1582246971.593434000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:27.434660+00:00" }, { "observable_id": "observable-8edb1f6f5d7b9c4c02b3759c", "type": "domain", "value": "s-0001.s-msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 3149, "display_filter": "frame.number == 3149", "timestamp_epoch": "1582247357.668186000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b4da2ce053f7692753009c17", "type": "domain", "value": "s-ring.msedge.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:27.612332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.610496+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 922, "display_filter": "frame.number == 922", "timestamp_epoch": "1582246456.548808000" }, { "udp_stream": 42, "frame_number": 928, "display_filter": "frame.number == 928", "timestamp_epoch": "1582246457.550518000" }, { "udp_stream": 42, "frame_number": 1020, "display_filter": "frame.number == 1020", "timestamp_epoch": "1582246458.550528000" }, { "udp_stream": 42, "frame_number": 1034, "display_filter": "frame.number == 1034", "timestamp_epoch": "1582246460.567597000" }, { "udp_stream": 42, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1582246460.902826000" }, { "tcp_stream": 50, "frame_number": 1043, "display_filter": "frame.number == 1043", "timestamp_epoch": "1582246461.020773000" }, { "tcp_stream": 94, "frame_number": 4513, "display_filter": "frame.number == 4513", "timestamp_epoch": "1582247512.351164000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:27.608179+00:00" }, { "observable_id": "observable-6e87a09466622f08a1aa83d3", "type": "domain", "value": "self.events.data.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:27.827868+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.825495+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 676, "display_filter": "frame.number == 676", "timestamp_epoch": "1582246442.929497000" }, { "udp_stream": 36, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1582246443.041084000" }, { "udp_stream": 48, "frame_number": 1233, "display_filter": "frame.number == 1233", "timestamp_epoch": "1582246473.838979000" }, { "udp_stream": 48, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1582246474.059399000" }, { "udp_stream": 52, "frame_number": 1570, "display_filter": "frame.number == 1570", "timestamp_epoch": "1582246512.594997000" }, { "udp_stream": 52, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1582246512.742109000" }, { "tcp_stream": 34, "frame_number": 681, "display_filter": "frame.number == 681", "timestamp_epoch": "1582246443.186153000" }, { "tcp_stream": 58, "frame_number": 1238, "display_filter": "frame.number == 1238", "timestamp_epoch": "1582246474.230432000" }, { "tcp_stream": 61, "frame_number": 1579, "display_filter": "frame.number == 1579", "timestamp_epoch": "1582246513.012628000" }, { "tcp_stream": 73, "frame_number": 1876, "display_filter": "frame.number == 1876", "timestamp_epoch": "1582246763.360785000" }, { "tcp_stream": 74, "frame_number": 1909, "display_filter": "frame.number == 1909", "timestamp_epoch": "1582246869.204521000" }, { "tcp_stream": 80, "frame_number": 2188, "display_filter": "frame.number == 2188", "timestamp_epoch": "1582247183.152269000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:27.823294+00:00" }, { "observable_id": "observable-5950a205ba083e4957a60d11", "type": "domain", "value": "self.events.data.onecollector.akadns.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1582246474.059399000" }, { "udp_stream": 52, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1582246512.742109000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6d098c50ae4766831ba53c1e", "type": "domain", "value": "tlu.dl.delivery.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.237498+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.045988+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.041374+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 5779, "display_filter": "frame.number == 5779", "timestamp_epoch": "1582247647.604485000" }, { "udp_stream": 82, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1582247647.697828000" }, { "tcp_stream": 114, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1582247647.791570000" }, { "tcp_stream": 115, "frame_number": 5806, "display_filter": "frame.number == 5806", "timestamp_epoch": "1582247647.791739000" }, { "tcp_stream": 112, "frame_number": 5808, "display_filter": "frame.number == 5808", "timestamp_epoch": "1582247647.791889000" }, { "tcp_stream": 113, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1582247647.792050000" }, { "tcp_stream": 117, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1582247648.842040000" }, { "tcp_stream": 118, "frame_number": 5880, "display_filter": "frame.number == 5880", "timestamp_epoch": "1582247648.853066000" }, { "tcp_stream": 119, "frame_number": 5882, "display_filter": "frame.number == 5882", "timestamp_epoch": "1582247648.853312000" }, { "tcp_stream": 120, "frame_number": 5884, "display_filter": "frame.number == 5884", "timestamp_epoch": "1582247648.853546000" }, { "tcp_stream": 120, "frame_number": 5894, "display_filter": "frame.number == 5894", "timestamp_epoch": "1582247648.964297000" }, { "tcp_stream": 117, "frame_number": 5896, "display_filter": "frame.number == 5896", "timestamp_epoch": "1582247648.974578000" }, { "tcp_stream": 124, "frame_number": 7066, "display_filter": "frame.number == 7066", "timestamp_epoch": "1582247649.678232000" }, { "tcp_stream": 125, "frame_number": 7069, "display_filter": "frame.number == 7069", "timestamp_epoch": "1582247649.678457000" }, { "tcp_stream": 125, "frame_number": 7398, "display_filter": "frame.number == 7398", "timestamp_epoch": "1582247649.844921000" }, { "tcp_stream": 128, "frame_number": 7710, "display_filter": "frame.number == 7710", "timestamp_epoch": "1582247650.216638000" }, { "tcp_stream": 127, "frame_number": 7720, "display_filter": "frame.number == 7720", "timestamp_epoch": "1582247650.216920000" }, { "tcp_stream": 128, "frame_number": 7969, "display_filter": "frame.number == 7969", "timestamp_epoch": "1582247650.353753000" }, { "tcp_stream": 131, "frame_number": 8949, "display_filter": "frame.number == 8949", "timestamp_epoch": "1582247651.480063000" }, { "tcp_stream": 132, "frame_number": 8951, "display_filter": "frame.number == 8951", "timestamp_epoch": "1582247651.480147000" } ], "roles": [ "dns-query", "http-host" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:24.036207+00:00" }, { "observable_id": "observable-ef21cb9dd7e52b1293d730e8", "type": "domain", "value": "tsfe.trafficmanager.net", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5526, "display_filter": "frame.number == 5526", "timestamp_epoch": "1582247641.965800000" } ], "roles": [ "dns-cname" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-910aa7f3a44c175b9b909a54", "type": "domain", "value": "tsfe.trafficshaping.dsp.mp.microsoft.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:27.990330+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.988333+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5523, "display_filter": "frame.number == 5523", "timestamp_epoch": "1582247640.723717000" }, { "udp_stream": 75, "frame_number": 5524, "display_filter": "frame.number == 5524", "timestamp_epoch": "1582247640.931841000" }, { "udp_stream": 75, "frame_number": 5525, "display_filter": "frame.number == 5525", "timestamp_epoch": "1582247641.962233000" }, { "udp_stream": 75, "frame_number": 5526, "display_filter": "frame.number == 5526", "timestamp_epoch": "1582247641.965800000" }, { "tcp_stream": 101, "frame_number": 5530, "display_filter": "frame.number == 5530", "timestamp_epoch": "1582247642.109241000" }, { "tcp_stream": 102, "frame_number": 5562, "display_filter": "frame.number == 5562", "timestamp_epoch": "1582247642.888828000" }, { "tcp_stream": 103, "frame_number": 5599, "display_filter": "frame.number == 5599", "timestamp_epoch": "1582247643.679977000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:27.986109+00:00" }, { "observable_id": "observable-9238c00a570c5784f4afc154", "type": "domain", "value": "wpad.localdomain", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 11, "frame_number": 29, "display_filter": "frame.number == 29", "timestamp_epoch": "1582246431.541544000" }, { "udp_stream": 11, "frame_number": 30, "display_filter": "frame.number == 30", "timestamp_epoch": "1582246431.541833000" }, { "udp_stream": 38, "frame_number": 711, "display_filter": "frame.number == 711", "timestamp_epoch": "1582246446.555212000" }, { "udp_stream": 38, "frame_number": 712, "display_filter": "frame.number == 712", "timestamp_epoch": "1582246446.555436000" }, { "udp_stream": 51, "frame_number": 1336, "display_filter": "frame.number == 1336", "timestamp_epoch": "1582246506.556761000" }, { "udp_stream": 51, "frame_number": 1337, "display_filter": "frame.number == 1337", "timestamp_epoch": "1582246506.556980000" }, { "udp_stream": 64, "frame_number": 2177, "display_filter": "frame.number == 2177", "timestamp_epoch": "1582247106.569997000" }, { "udp_stream": 64, "frame_number": 2178, "display_filter": "frame.number == 2178", "timestamp_epoch": "1582247106.570166000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4271ff0e774baf8098d1012c", "type": "domain", "value": "wpad.one-hot-mess.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 10, "frame_number": 27, "display_filter": "frame.number == 27", "timestamp_epoch": "1582246431.534875000" }, { "udp_stream": 10, "frame_number": 28, "display_filter": "frame.number == 28", "timestamp_epoch": "1582246431.535139000" }, { "udp_stream": 37, "frame_number": 709, "display_filter": "frame.number == 709", "timestamp_epoch": "1582246446.554333000" }, { "udp_stream": 37, "frame_number": 710, "display_filter": "frame.number == 710", "timestamp_epoch": "1582246446.554749000" }, { "udp_stream": 50, "frame_number": 1334, "display_filter": "frame.number == 1334", "timestamp_epoch": "1582246506.555990000" }, { "udp_stream": 50, "frame_number": 1335, "display_filter": "frame.number == 1335", "timestamp_epoch": "1582246506.556316000" }, { "udp_stream": 63, "frame_number": 2175, "display_filter": "frame.number == 2175", "timestamp_epoch": "1582247106.569307000" }, { "udp_stream": 63, "frame_number": 2176, "display_filter": "frame.number == 2176", "timestamp_epoch": "1582247106.569609000" } ], "roles": [ "dns-query" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-44a03c82ff1877983cebe8f0", "type": "domain", "value": "www.bing.com", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:28.166581+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.164811+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 921, "display_filter": "frame.number == 921", "timestamp_epoch": "1582246456.491647000" }, { "udp_stream": 41, "frame_number": 924, "display_filter": "frame.number == 924", "timestamp_epoch": "1582246456.608292000" }, { "udp_stream": 55, "frame_number": 1708, "display_filter": "frame.number == 1708", "timestamp_epoch": "1582246560.531193000" }, { "udp_stream": 55, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1582246560.676996000" }, { "tcp_stream": 46, "frame_number": 940, "display_filter": "frame.number == 940", "timestamp_epoch": "1582246457.813124000" }, { "tcp_stream": 47, "frame_number": 941, "display_filter": "frame.number == 941", "timestamp_epoch": "1582246457.813278000" }, { "tcp_stream": 51, "frame_number": 1065, "display_filter": "frame.number == 1065", "timestamp_epoch": "1582246462.267652000" }, { "tcp_stream": 67, "frame_number": 1713, "display_filter": "frame.number == 1713", "timestamp_epoch": "1582246560.763316000" }, { "tcp_stream": 92, "frame_number": 4472, "display_filter": "frame.number == 4472", "timestamp_epoch": "1582247510.448404000" } ], "roles": [ "dns-query", "tls-sni" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:28.162733+00:00" }, { "observable_id": "observable-4125f35b52d185232a9f910d", "type": "ipv4", "value": "0.0.0.0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-9352bf4fffe94bacc5819799", "type": "ipv4", "value": "104.77.69.193", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:29.442450+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.436682+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 77, "frame_number": 5659, "display_filter": "frame.number == 5659", "timestamp_epoch": "1582247646.003943000" }, { "udp_stream": 78, "frame_number": 5685, "display_filter": "frame.number == 5685", "timestamp_epoch": "1582247646.674447000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:29.430345+00:00" }, { "observable_id": "observable-4929c8a4d34403a327b2b277", "type": "ipv4", "value": "13.107.21.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 924, "display_filter": "frame.number == 924", "timestamp_epoch": "1582246456.608292000" }, { "udp_stream": 55, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1582246560.676996000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-bbba987cdc38be71ecfe574e", "type": "ipv4", "value": "13.107.246.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:29.646359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.640398+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 59, "frame_number": 1942, "display_filter": "frame.number == 1942", "timestamp_epoch": "1582246971.491797000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:29.635312+00:00" }, { "observable_id": "observable-193b9306e08a81574d06fc22", "type": "ipv4", "value": "13.107.3.128", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:29.865521+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.861112+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 69, "frame_number": 3149, "display_filter": "frame.number == 3149", "timestamp_epoch": "1582247357.668186000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:29.856350+00:00" }, { "observable_id": "observable-b4bef3ae5467e7802293ded1", "type": "ipv4", "value": "13.107.3.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:30.093827+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.089127+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 42, "frame_number": 1035, "display_filter": "frame.number == 1035", "timestamp_epoch": "1582246460.902826000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:30.083450+00:00" }, { "observable_id": "observable-0bd65b245da76298a22864a4", "type": "ipv4", "value": "13.107.4.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:30.315008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.312304+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 44, "frame_number": 937, "display_filter": "frame.number == 937", "timestamp_epoch": "1582246457.808767000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:30.308679+00:00" }, { "observable_id": "observable-aa07c8df19a0668173d8f158", "type": "ipv4", "value": "13.107.4.50", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:30.525720+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.520454+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 80, "frame_number": 5742, "display_filter": "frame.number == 5742", "timestamp_epoch": "1582247647.303609000" }, { "udp_stream": 83, "frame_number": 8935, "display_filter": "frame.number == 8935", "timestamp_epoch": "1582247651.373628000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:30.514849+00:00" }, { "observable_id": "observable-904029c2f9e4d5ff36db75c9", "type": "ipv4", "value": "131.107.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 9, "frame_number": 31, "display_filter": "frame.number == 31", "timestamp_epoch": "1582246431.554751000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4358d5257db250713ba330d9", "type": "ipv4", "value": "172.17.8.1", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76c9ace0a30f9b0b3794bbd7", "type": "ipv4", "value": "172.17.8.174", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 30, "frame_number": 598, "display_filter": "frame.number == 598", "timestamp_epoch": "1582246435.853954000" }, { "udp_stream": 30, "frame_number": 599, "display_filter": "frame.number == 599", "timestamp_epoch": "1582246435.855180000" }, { "udp_stream": 66, "frame_number": 2222, "display_filter": "frame.number == 2222", "timestamp_epoch": "1582247330.056588000" }, { "udp_stream": 66, "frame_number": 2226, "display_filter": "frame.number == 2226", "timestamp_epoch": "1582247330.057439000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3f61019bd397b15ae9bc1c93", "type": "ipv4", "value": "172.17.8.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-45730801868d0c1bca799c98", "type": "ipv4", "value": "172.17.8.8", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 4, "frame_number": 10, "display_filter": "frame.number == 10", "timestamp_epoch": "1582246431.132004000" }, { "udp_stream": 5, "frame_number": 12, "display_filter": "frame.number == 12", "timestamp_epoch": "1582246431.141527000" }, { "udp_stream": 14, "frame_number": 37, "display_filter": "frame.number == 37", "timestamp_epoch": "1582246432.227512000" }, { "udp_stream": 17, "frame_number": 43, "display_filter": "frame.number == 43", "timestamp_epoch": "1582246432.289581000" }, { "udp_stream": 20, "frame_number": 213, "display_filter": "frame.number == 213", "timestamp_epoch": "1582246432.419998000" }, { "udp_stream": 22, "frame_number": 266, "display_filter": "frame.number == 266", "timestamp_epoch": "1582246432.537530000" }, { "udp_stream": 24, "frame_number": 280, "display_filter": "frame.number == 280", "timestamp_epoch": "1582246432.653831000" }, { "udp_stream": 26, "frame_number": 302, "display_filter": "frame.number == 302", "timestamp_epoch": "1582246432.718966000" }, { "udp_stream": 27, "frame_number": 517, "display_filter": "frame.number == 517", "timestamp_epoch": "1582246434.315645000" }, { "udp_stream": 29, "frame_number": 597, "display_filter": "frame.number == 597", "timestamp_epoch": "1582246435.852236000" }, { "udp_stream": 40, "frame_number": 774, "display_filter": "frame.number == 774", "timestamp_epoch": "1582246452.179824000" }, { "udp_stream": 46, "frame_number": 1183, "display_filter": "frame.number == 1183", "timestamp_epoch": "1582246464.533342000" }, { "udp_stream": 53, "frame_number": 1574, "display_filter": "frame.number == 1574", "timestamp_epoch": "1582246512.935824000" }, { "udp_stream": 52, "frame_number": 1799, "display_filter": "frame.number == 1799", "timestamp_epoch": "1582246733.394985000" }, { "udp_stream": 65, "frame_number": 2220, "display_filter": "frame.number == 2220", "timestamp_epoch": "1582247330.055503000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f5d91350ab7d99359843dbc4", "type": "ipv4", "value": "20.190.133.66", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-da57a8a5cf10cf0786ec6638", "type": "ipv4", "value": "20.190.133.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-def5ac5511ceb7e5f1723b23", "type": "ipv4", "value": "20.190.133.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-db7a8d09200d61729719e21f", "type": "ipv4", "value": "204.79.197.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:30.957464+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.952627+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 41, "frame_number": 924, "display_filter": "frame.number == 924", "timestamp_epoch": "1582246456.608292000" }, { "udp_stream": 55, "frame_number": 1709, "display_filter": "frame.number == 1709", "timestamp_epoch": "1582246560.676996000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:30.947136+00:00" }, { "observable_id": "observable-9a793667f8f456714999a1e6", "type": "ipv4", "value": "204.79.197.222", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:31.207737+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.205042+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 72, "frame_number": 4437, "display_filter": "frame.number == 4437", "timestamp_epoch": "1582247509.811440000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:31.202138+00:00" }, { "observable_id": "observable-f10db5ad2b4dad781f9e4af1", "type": "ipv4", "value": "204.79.197.254", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:31.390735+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.388338+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 74, "frame_number": 4671, "display_filter": "frame.number == 4671", "timestamp_epoch": "1582247513.802766000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:31.385438+00:00" }, { "observable_id": "observable-7cb42e06f57adff2b355999b", "type": "ipv4", "value": "205.185.216.10", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:31.619932+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.617309+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1582247647.697828000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:31.613670+00:00" }, { "observable_id": "observable-3650f0f11b426cb85e8d35a3", "type": "ipv4", "value": "205.185.216.42", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.550125+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.244828+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.240855+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 82, "frame_number": 5789, "display_filter": "frame.number == 5789", "timestamp_epoch": "1582247647.697828000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:24.237557+00:00" }, { "observable_id": "observable-27b9228142a8b975fb22bd6d", "type": "ipv4", "value": "224.0.0.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-022fc7fb74e9122329896b5a", "type": "ipv4", "value": "224.0.0.251", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c51231e7c28dcab5e47dab25", "type": "ipv4", "value": "224.0.0.252", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-6f634acb0e243309e77ccb39", "type": "ipv4", "value": "23.1.236.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-76e09a0250c504de6d4373aa", "type": "ipv4", "value": "23.1.236.107", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f8f71e1113d06ff1e40410f5", "type": "ipv4", "value": "23.1.236.114", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:31.823972+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.821285+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:31.817620+00:00" }, { "observable_id": "observable-4687948311eb6140068d450d", "type": "ipv4", "value": "23.1.236.125", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-5fa364954c9aa79e75044ff3", "type": "ipv4", "value": "23.1.236.74", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-dd5bc71e4f4dcbe832582f91", "type": "ipv4", "value": "23.1.236.75", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f1f0600b822b1bd6764ad67a", "type": "ipv4", "value": "23.1.236.85", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97584b7141b6c19d191acf3b", "type": "ipv4", "value": "23.1.236.92", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:32.030995+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.025890+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:32.019558+00:00" }, { "observable_id": "observable-402fa74cceafefcf90ada8c5", "type": "ipv4", "value": "23.1.236.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 81, "frame_number": 5776, "display_filter": "frame.number == 5776", "timestamp_epoch": "1582247647.592563000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-70847d8cc76c81ae595d944a", "type": "ipv4", "value": "23.54.20.119", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:32.334182+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.332387+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 71, "frame_number": 2353, "display_filter": "frame.number == 2353", "timestamp_epoch": "1582247355.864518000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:32.329929+00:00" }, { "observable_id": "observable-7c2732937ce38f94655360b9", "type": "ipv4", "value": "23.54.20.139", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:32.541387+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.537200+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 43, "frame_number": 936, "display_filter": "frame.number == 936", "timestamp_epoch": "1582246457.808708000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:32.532027+00:00" }, { "observable_id": "observable-5dc8cd10f69503dde9045a47", "type": "ipv4", "value": "255.255.255.255", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d4e283c6b3ea69f4a49665ee", "type": "ipv4", "value": "40.126.5.100", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-14e6e7c3947eaa6d8bb2c6fd", "type": "ipv4", "value": "40.126.5.35", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:32.854694+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.850406+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:32.844941+00:00" }, { "observable_id": "observable-5e10218ceb5e86eb215637b2", "type": "ipv4", "value": "40.126.5.37", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-046c703f882eaf67b9bc98ed", "type": "ipv4", "value": "40.126.5.98", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-426148b5f0ee6ec9595ce209", "type": "ipv4", "value": "40.126.5.99", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 45, "frame_number": 1180, "display_filter": "frame.number == 1180", "timestamp_epoch": "1582246464.271335000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-f1fc3cfd7e86d772338a2ddf", "type": "ipv4", "value": "40.69.216.73", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:33.120522+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.115723+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 76, "frame_number": 5635, "display_filter": "frame.number == 5635", "timestamp_epoch": "1582247644.559781000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:33.110747+00:00" }, { "observable_id": "observable-1c0d3bab70aac371b74597dd", "type": "ipv4", "value": "40.91.116.226", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:33.505317+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.499772+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:33.494072+00:00" }, { "observable_id": "observable-5263069858ff29b11f523688", "type": "ipv4", "value": "40.91.120.196", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 61, "frame_number": 2036, "display_filter": "frame.number == 2036", "timestamp_epoch": "1582247034.931427000" } ], "roles": [ "dns-answer" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4e2c5d25c852e9d17ce17b95", "type": "ipv4", "value": "49.51.172.56", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.759995+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.553763+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.551979+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 49, "frame_number": 1332, "display_filter": "frame.number == 1332", "timestamp_epoch": "1582246506.447128000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:24.550162+00:00" }, { "observable_id": "observable-5a1306761a23e2137dac2e29", "type": "ipv4", "value": "52.109.124.20", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:33.772976+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.768736+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 56, "frame_number": 1744, "display_filter": "frame.number == 1744", "timestamp_epoch": "1582246584.856481000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:33.764451+00:00" }, { "observable_id": "observable-afc88ce283c22562e8d1279c", "type": "ipv4", "value": "52.109.2.55", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:33.970989+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.966246+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 70, "frame_number": 2320, "display_filter": "frame.number == 2320", "timestamp_epoch": "1582247354.748161000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:33.960503+00:00" }, { "observable_id": "observable-d3c67a9441beb89e20e85500", "type": "ipv4", "value": "52.114.128.9", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:34.279727+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.277861+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 48, "frame_number": 1234, "display_filter": "frame.number == 1234", "timestamp_epoch": "1582246474.059399000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:34.275750+00:00" }, { "observable_id": "observable-3de2ef556760130793de8b99", "type": "ipv4", "value": "52.114.132.22", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:34.471565+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.465138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 36, "frame_number": 677, "display_filter": "frame.number == 677", "timestamp_epoch": "1582246443.041084000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:34.462601+00:00" }, { "observable_id": "observable-a1b2bf7acdb85461ddd4e318", "type": "ipv4", "value": "52.114.76.34", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:34.792358+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.789987+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 52, "frame_number": 1571, "display_filter": "frame.number == 1571", "timestamp_epoch": "1582246512.742109000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:34.787384+00:00" }, { "observable_id": "observable-48f337dfe26d08829c3b46de", "type": "ipv4", "value": "52.159.17.76", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:34.969657+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.967164+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 75, "frame_number": 5526, "display_filter": "frame.number == 5526", "timestamp_epoch": "1582247641.965800000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:34.964374+00:00" }, { "observable_id": "observable-832b20af9d2129f3f00a68c5", "type": "ipv4", "value": "52.230.222.68", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:35.208860+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.203701+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 58, "frame_number": 1944, "display_filter": "frame.number == 1944", "timestamp_epoch": "1582246971.561272000" }, { "udp_stream": 60, "frame_number": 2008, "display_filter": "frame.number == 2008", "timestamp_epoch": "1582247032.420357000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:35.198302+00:00" }, { "observable_id": "observable-ce72b62e190eaf310460deaf", "type": "ipv4", "value": "64.4.54.18", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:35.515524+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.509858+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 62, "frame_number": 2122, "display_filter": "frame.number == 2122", "timestamp_epoch": "1582247037.024283000" }, { "udp_stream": 68, "frame_number": 2250, "display_filter": "frame.number == 2250", "timestamp_epoch": "1582247334.195082000" }, { "udp_stream": 79, "frame_number": 5692, "display_filter": "frame.number == 5692", "timestamp_epoch": "1582247646.788647000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:35.505133+00:00" }, { "observable_id": "observable-f4e673c99a1067c26977c12d", "type": "ipv4", "value": "72.21.81.200", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:35.712902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.711029+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "udp_stream": 73, "frame_number": 4541, "display_filter": "frame.number == 4541", "timestamp_epoch": "1582247513.062427000" } ], "roles": [ "dns-answer", "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:35.708721+00:00" }, { "observable_id": "observable-ef5bbf89cf708c774c6a436d", "type": "ipv4", "value": "91.211.88.122", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:36.055902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.052119+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "network-endpoint" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:36.047053+00:00" }, { "observable_id": "observable-68d84fd3015161cf881a1bb5", "type": "sha256", "value": "03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:23.486307+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:23.274349+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.271538+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:23.268210+00:00" }, { "observable_id": "observable-79699e175e249cfc0d23e7e2", "type": "sha256", "value": "166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a5dcf8ccc13bc8ff59e9b580", "type": "sha256", "value": "647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-d3e4a48491ef54d9fa85f133", "type": "sha256", "value": "6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-b9078d2c4dc1d8b381a51ddf", "type": "sha256", "value": "7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-e1a13b36dc940a2fe9250f7f", "type": "sha256", "value": "9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.997696+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "evidence": {}, "cache_hit": false, "queried_at": "2026-09-22T17:45:24.771097+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [] }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "evidence": {}, "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.765166+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [] } ], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "partial", "queried_at": "2026-09-22T17:45:24.760062+00:00" }, { "observable_id": "observable-b95c47a89d6c6febed11a33d", "type": "sha256", "value": "a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-68570bec3cb57d8b37c4cf2b", "type": "sha256", "value": "bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-84c9046e70a6ffc825aca018", "type": "sha256", "value": "f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-00bfcccdb142ab388a02f7a4", "type": "sha256", "value": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [], "roles": [ "exported-object" ], "enrichment_eligible": true, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-1cf2ea0faa9fbdc19cd5ee7f", "type": "url", "value": "http://2.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 135, "frame_number": 8989, "display_filter": "frame.number == 8989", "timestamp_epoch": "1582247651.642417000" }, { "tcp_stream": 136, "frame_number": 8991, "display_filter": "frame.number == 8991", "timestamp_epoch": "1582247651.642504000" }, { "tcp_stream": 136, "frame_number": 9003, "display_filter": "frame.number == 9003", "timestamp_epoch": "1582247651.737305000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c7d302d4c29b1dd4b501ce9a", "type": "url", "value": "http://blueflag.xyz/nCvQOQHCBjZFfiJvyVGA/yrkbdmt.bin", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 60, "frame_number": 1340, "display_filter": "frame.number == 1340", "timestamp_epoch": "1582246506.703102000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-a58d13f25df672cb14813249", "type": "url", "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3/pieceshash", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 109, "frame_number": 5753, "display_filter": "frame.number == 5753", "timestamp_epoch": "1582247647.389889000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-0aa3f2224acb1140b4c8d9ea", "type": "url", "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428/pieceshash", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 130, "frame_number": 8927, "display_filter": "frame.number == 8927", "timestamp_epoch": "1582247651.329111000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-63e133730afba2a4a0cc44d3", "type": "url", "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf/pieceshash", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 126, "frame_number": 7409, "display_filter": "frame.number == 7409", "timestamp_epoch": "1582247649.954012000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c5d9a386662f53a603df7d18", "type": "url", "value": "http://dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb/pieceshash", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 122, "frame_number": 6576, "display_filter": "frame.number == 6576", "timestamp_epoch": "1582247649.446551000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-c687310dfc5c012006a2c9a0", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1580335569&P2=402&P3=2&P4=NFqvAzoi8KK%2blIuW%2bABh0rnEWK2NH4vlr6zhdN4Sz%2bNlRhD0tiaLUAY46FJc4MDFnb9tPRqfgd6ZsqedUt2Rkg%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 112, "frame_number": 5808, "display_filter": "frame.number == 5808", "timestamp_epoch": "1582247647.791889000" }, { "tcp_stream": 113, "frame_number": 5810, "display_filter": "frame.number == 5810", "timestamp_epoch": "1582247647.792050000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-08d0722a24a8048eb57d3526", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/001eb2ac-b2c2-4a55-a78d-85def1f04de3?P1=1582248309&P2=402&P3=2&P4=OYTOMAM70Q%2fd4derugeBOPD04WTCco6vqlRyNC88eIAsg1VNhSoG17x8uiLzMbHy2dVKNG0nn3I27FhkzBDDdA%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 119, "frame_number": 5882, "display_filter": "frame.number == 5882", "timestamp_epoch": "1582247648.853312000" }, { "tcp_stream": 120, "frame_number": 5884, "display_filter": "frame.number == 5884", "timestamp_epoch": "1582247648.853546000" }, { "tcp_stream": 120, "frame_number": 5894, "display_filter": "frame.number == 5894", "timestamp_epoch": "1582247648.964297000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-4c3d9e027c6a5abf2157a5e9", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1580335569&P2=402&P3=2&P4=mABV5ffFfCEQA8rkWFvC1CL3DDKuapd6HyRMLFxQjWmV72eklsHfgpppXIda1%2bRuNGLixGGxcRUiVi7ZBcMAew%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 114, "frame_number": 5804, "display_filter": "frame.number == 5804", "timestamp_epoch": "1582247647.791570000" }, { "tcp_stream": 115, "frame_number": 5806, "display_filter": "frame.number == 5806", "timestamp_epoch": "1582247647.791739000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-18e10eeaeb2272968ccaebfd", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0092fb1c-d27f-429c-acdd-29b392ed3d33?P1=1582248309&P2=402&P3=2&P4=VuCE7u3Zf5IiBceaCNrkpClSEVPiLmM%2fpC6%2fdew0ptQMkTG%2bP3ouy1xjONnUVdgjBchgeLOocenO5tPhl2jcBg%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 117, "frame_number": 5870, "display_filter": "frame.number == 5870", "timestamp_epoch": "1582247648.842040000" }, { "tcp_stream": 118, "frame_number": 5880, "display_filter": "frame.number == 5880", "timestamp_epoch": "1582247648.853066000" }, { "tcp_stream": 117, "frame_number": 5896, "display_filter": "frame.number == 5896", "timestamp_epoch": "1582247648.974578000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-3fb13ac1ebb51cc8e4a4c67c", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/669bf2c3-676c-4886-abcb-369234eb0428?P1=1580334556&P2=402&P3=2&P4=ZPf97M7klbXT%2fiRNSu6Eqg8BMn0rc6JjOeqYP1khMmQ7nX%2fMt1he6JVA49UcPJuKKM2fjYEVwvUXSDZdJnj67w%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 133, "frame_number": 8959, "display_filter": "frame.number == 8959", "timestamp_epoch": "1582247651.530518000" }, { "tcp_stream": 134, "frame_number": 8961, "display_filter": "frame.number == 8961", "timestamp_epoch": "1582247651.530634000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-97d0b6d9d4409deb9c13868c", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9ed29ecb-8df0-4d34-83a5-a3fdd56a2aaf?P1=1582248747&P2=402&P3=2&P4=TAzJjyxXFI27ORkb4DNfuNA%2b9JMn92MahjGqaWxsTi7fJbQdQB4qsf32Czn6AStBUsxhKoRrB8s7zcmbNTo9vg%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 128, "frame_number": 7710, "display_filter": "frame.number == 7710", "timestamp_epoch": "1582247650.216638000" }, { "tcp_stream": 127, "frame_number": 7720, "display_filter": "frame.number == 7720", "timestamp_epoch": "1582247650.216920000" }, { "tcp_stream": 128, "frame_number": 7969, "display_filter": "frame.number == 7969", "timestamp_epoch": "1582247650.353753000" }, { "tcp_stream": 131, "frame_number": 8949, "display_filter": "frame.number == 8949", "timestamp_epoch": "1582247651.480063000" }, { "tcp_stream": 132, "frame_number": 8951, "display_filter": "frame.number == 8951", "timestamp_epoch": "1582247651.480147000" }, { "tcp_stream": 137, "frame_number": 8999, "display_filter": "frame.number == 8999", "timestamp_epoch": "1582247651.700292000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null }, { "observable_id": "observable-75a37deaeb8d7ab197a02c6d", "type": "url", "value": "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ae6344f1-6475-4365-b7bd-43e79abac1fb?P1=1582248267&P2=402&P3=2&P4=X16ZdLJ5vV9c6XJIjdHBVzqyQCDdZLY0XQG0gTzaQebQOvWdznZdEHwJ5VGSjaQYMvA6THNqvtvf45ZlGQuHkw%3d%3d", "classification": "observed", "ioc_candidate": false, "reasons": [], "signals": [], "provider_conflict": false, "ioc_selection_note": "Observation only", "evidence": [ { "tcp_stream": 124, "frame_number": 7066, "display_filter": "frame.number == 7066", "timestamp_epoch": "1582247649.678232000" }, { "tcp_stream": 125, "frame_number": 7069, "display_filter": "frame.number == 7069", "timestamp_epoch": "1582247649.678457000" }, { "tcp_stream": 125, "frame_number": 7398, "display_filter": "frame.number == 7398", "timestamp_epoch": "1582247649.844921000" } ], "roles": [ "http-request" ], "enrichment_eligible": false, "enrichment_status": "not-requested", "queried_at": null } ], "counts": { "observed": 117 }, "ioc_candidate_count": 0, "summary": "117 typed observations; 0 evidence-backed IOC candidates for review, including 0 with direct malicious provider reports. No automatic confirmation or attribution.", "limitations": [ "No detections, no record, missing credentials and provider errors do not mean benign.", "Current reputation may postdate the capture. Shared hosting, DNS resolution and graph overlap do not transfer maliciousness.", "A recovered file is not proof of execution; hashes identify exported bytes, including partial objects.", "Public-looking enterprise domains may still be sensitive: review selected targets before external disclosure." ], "enrichment_plan": { "policy": "evidence-priority-v2", "items": [ { "observable_id": "observable-79699e175e249cfc0d23e7e2", "type": "sha256", "value": "166206dd8ef90ae913ecc5c7304cce32709979d750410f31def100a79350625e", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a5dcf8ccc13bc8ff59e9b580", "type": "sha256", "value": "647e5a1e629fd08daaccc0e062357c3e24b874e4e2e81995663acf51d9c03e78", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3e4a48491ef54d9fa85f133", "type": "sha256", "value": "6b0d7c91afe49a12e5dfa53f3a76bdece18aa2bd2f086de89c023af96da962dc", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b9078d2c4dc1d8b381a51ddf", "type": "sha256", "value": "7909a4851b92ebbf004e97b5636d518bdf3c9cc4cfd14e4296ec9b20ae3fad48", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b95c47a89d6c6febed11a33d", "type": "sha256", "value": "a09251f59ac89347aba040d1b5952a27bc203a30c85b9e6e6269ea7371554961", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-68570bec3cb57d8b37c4cf2b", "type": "sha256", "value": "bb7d5779e2ed80dc691cf41026bce0372d36a68dea5a8e86c701add1d057dee0", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-84c9046e70a6ffc825aca018", "type": "sha256", "value": "f57d16ffc3ed1353f1d40c634b8520eddc5fd333831bb57b17dc92b2659b5513", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-00bfcccdb142ab388a02f7a4", "type": "sha256", "value": "fcab7fcc2b4cffd9bb45003bfc2e468a04ef6f77ca8200a7341f027631584d25", "priority": 25, "reasons": [ "recovered-unclassified-bytes" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f218733a0a70e24df865caf3", "type": "domain", "value": "dns.msftncsi.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9238c00a570c5784f4afc154", "type": "domain", "value": "wpad.localdomain", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4271ff0e774baf8098d1012c", "type": "domain", "value": "wpad.one-hot-mess.com", "priority": 20, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3cc9006a45ba81f153483329", "type": "domain", "value": "fe2cr.update.microsoft.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b53690dd705070db4bd396e2", "type": "domain", "value": "prod.mrodevicemgr.live.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ea56484321f7343708de83a5", "type": "domain", "value": "prod.nexusrules.live.com.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-8edb1f6f5d7b9c4c02b3759c", "type": "domain", "value": "s-0001.s-msedge.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5950a205ba083e4957a60d11", "type": "domain", "value": "self.events.data.onecollector.akadns.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef21cb9dd7e52b1293d730e8", "type": "domain", "value": "tsfe.trafficmanager.net", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4929c8a4d34403a327b2b277", "type": "ipv4", "value": "13.107.21.200", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-904029c2f9e4d5ff36db75c9", "type": "ipv4", "value": "131.107.255.255", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f5d91350ab7d99359843dbc4", "type": "ipv4", "value": "20.190.133.66", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-da57a8a5cf10cf0786ec6638", "type": "ipv4", "value": "20.190.133.75", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-def5ac5511ceb7e5f1723b23", "type": "ipv4", "value": "20.190.133.76", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6f634acb0e243309e77ccb39", "type": "ipv4", "value": "23.1.236.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-76e09a0250c504de6d4373aa", "type": "ipv4", "value": "23.1.236.107", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4687948311eb6140068d450d", "type": "ipv4", "value": "23.1.236.125", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5fa364954c9aa79e75044ff3", "type": "ipv4", "value": "23.1.236.74", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-dd5bc71e4f4dcbe832582f91", "type": "ipv4", "value": "23.1.236.75", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1f0600b822b1bd6764ad67a", "type": "ipv4", "value": "23.1.236.85", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-402fa74cceafefcf90ada8c5", "type": "ipv4", "value": "23.1.236.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4e283c6b3ea69f4a49665ee", "type": "ipv4", "value": "40.126.5.100", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5e10218ceb5e86eb215637b2", "type": "ipv4", "value": "40.126.5.37", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-046c703f882eaf67b9bc98ed", "type": "ipv4", "value": "40.126.5.98", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-426148b5f0ee6ec9595ce209", "type": "ipv4", "value": "40.126.5.99", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5263069858ff29b11f523688", "type": "ipv4", "value": "40.91.120.196", "priority": 10, "reasons": [ "observed-in-capture" ], "direct_checked": false, "checked_providers": [], "pending_providers": [], "retryable_providers": [], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-68d84fd3015161cf881a1bb5", "type": "sha256", "value": "03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066", "priority": 95, "reasons": [ "recovered-pe-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e398b99b7298c2051a7515bf", "type": "domain", "value": "blueflag.xyz", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6d098c50ae4766831ba53c1e", "type": "domain", "value": "tlu.dl.delivery.mp.microsoft.com", "priority": 80, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3650f0f11b426cb85e8d35a3", "type": "ipv4", "value": "205.185.216.42", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e2c5d25c852e9d17ce17b95", "type": "ipv4", "value": "49.51.172.56", "priority": 80, "reasons": [ "http_request-peer", "served-inspectable-file-not-transitive-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e1a13b36dc940a2fe9250f7f", "type": "sha256", "value": "9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86", "priority": 70, "reasons": [ "recovered-zip-bytes" ], "direct_checked": false, "checked_providers": [ "malwarebazaar", "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-c349b7dea7701eb5f08b8166", "type": "domain", "value": "2.tlu.dl.delivery.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3bb5fa3eff5e90d80d21b02f", "type": "domain", "value": "a-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2dd4da9939590bf47ce130a1", "type": "domain", "value": "c-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4f7606fe25c93bc00e9118f", "type": "domain", "value": "client.wns.windows.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f246f830f03a9bac92c2ba70", "type": "domain", "value": "config.edge.skype.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0075d192b861939e9f6b02cf", "type": "domain", "value": "cp601.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-842154a116009726355665e6", "type": "domain", "value": "dl.delivery.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-http-host" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4e9abe268dc5b27b00f966bd", "type": "domain", "value": "fe2cr.update.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-997b10cc201e2f00c72fbbfb", "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-33de7a5adbe981f8b5184ad2", "type": "domain", "value": "fp-vp.azureedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d4fe61ac00ef13a73068254f", "type": "domain", "value": "fp.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7064ff870df471c261be7ee8", "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e23c94b5a225dafc7d7c6c6c", "type": "domain", "value": "kv601.prod.do.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-19d710883d074b712e06d19c", "type": "domain", "value": "login.microsoftonline.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-4caeed826ff17cc5f3d2ee16", "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-10556fc0804ab0fbe3417c21", "type": "domain", "value": "nexusrules.officeapps.live.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-cfeb22aa1594a7b22fad8960", "type": "domain", "value": "officecdn.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-2637add9a016aa48bbf03342", "type": "domain", "value": "ow1.res.office365.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-99789dea42e0a12771b7e662", "type": "domain", "value": "pti.store.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4da2ce053f7692753009c17", "type": "domain", "value": "s-ring.msedge.net", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-6e87a09466622f08a1aa83d3", "type": "domain", "value": "self.events.data.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-910aa7f3a44c175b9b909a54", "type": "domain", "value": "tsfe.trafficshaping.dsp.mp.microsoft.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-44a03c82ff1877983cebe8f0", "type": "domain", "value": "www.bing.com", "priority": 46, "reasons": [ "dns-name-not-resolver-verdict", "observed-tls-sni-content-unknown" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e6a1328fcbb2b3cba531392e", "type": "domain", "value": "7.tlu.dl.delivery.mp.microsoft.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-e69367184c4e7a668b9deb14", "type": "domain", "value": "desktop-tzmkhkc.one-hot-mess.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-fecda50588903bb943517377", "type": "domain", "value": "one-hot-mess-dc.one-hot-mess.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a94b2b32b7223853b50e152c", "type": "domain", "value": "one-hot-mess.com", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1810e0467b541bfdd2bab449", "type": "domain", "value": "one-hot-mess.net", "priority": 45, "reasons": [ "dns-name-not-resolver-verdict" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9352bf4fffe94bacc5819799", "type": "ipv4", "value": "104.77.69.193", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-bbba987cdc38be71ecfe574e", "type": "ipv4", "value": "13.107.246.10", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-193b9306e08a81574d06fc22", "type": "ipv4", "value": "13.107.3.128", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-b4bef3ae5467e7802293ded1", "type": "ipv4", "value": "13.107.3.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-0bd65b245da76298a22864a4", "type": "ipv4", "value": "13.107.4.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-aa07c8df19a0668173d8f158", "type": "ipv4", "value": "13.107.4.50", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-db7a8d09200d61729719e21f", "type": "ipv4", "value": "204.79.197.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-9a793667f8f456714999a1e6", "type": "ipv4", "value": "204.79.197.222", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f10db5ad2b4dad781f9e4af1", "type": "ipv4", "value": "204.79.197.254", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7cb42e06f57adff2b355999b", "type": "ipv4", "value": "205.185.216.10", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f8f71e1113d06ff1e40410f5", "type": "ipv4", "value": "23.1.236.114", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-97584b7141b6c19d191acf3b", "type": "ipv4", "value": "23.1.236.92", "priority": 45, "reasons": [ "http_request-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-70847d8cc76c81ae595d944a", "type": "ipv4", "value": "23.54.20.119", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-7c2732937ce38f94655360b9", "type": "ipv4", "value": "23.54.20.139", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-14e6e7c3947eaa6d8bb2c6fd", "type": "ipv4", "value": "40.126.5.35", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f1fc3cfd7e86d772338a2ddf", "type": "ipv4", "value": "40.69.216.73", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-1c0d3bab70aac371b74597dd", "type": "ipv4", "value": "40.91.116.226", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-5a1306761a23e2137dac2e29", "type": "ipv4", "value": "52.109.124.20", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-afc88ce283c22562e8d1279c", "type": "ipv4", "value": "52.109.2.55", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-d3c67a9441beb89e20e85500", "type": "ipv4", "value": "52.114.128.9", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-3de2ef556760130793de8b99", "type": "ipv4", "value": "52.114.132.22", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-a1b2bf7acdb85461ddd4e318", "type": "ipv4", "value": "52.114.76.34", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-48f337dfe26d08829c3b46de", "type": "ipv4", "value": "52.159.17.76", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-832b20af9d2129f3f00a68c5", "type": "ipv4", "value": "52.230.222.68", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ce72b62e190eaf310460deaf", "type": "ipv4", "value": "64.4.54.18", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-f4e673c99a1067c26977c12d", "type": "ipv4", "value": "72.21.81.200", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false }, { "observable_id": "observable-ef5bbf89cf708c774c6a436d", "type": "ipv4", "value": "91.211.88.122", "priority": 45, "reasons": [ "tls_client_hello-peer" ], "direct_checked": false, "checked_providers": [ "threatfox" ], "pending_providers": [ "virustotal" ], "retryable_providers": [ "virustotal" ], "queue_ready": true, "ioc_candidate": false } ], "eligible_count": 95, "next_batch": [ "observable-79699e175e249cfc0d23e7e2", "observable-a5dcf8ccc13bc8ff59e9b580", "observable-d3e4a48491ef54d9fa85f133", "observable-b9078d2c4dc1d8b381a51ddf", "observable-b95c47a89d6c6febed11a33d", "observable-68570bec3cb57d8b37c4cf2b", "observable-84c9046e70a6ffc825aca018", "observable-00bfcccdb142ab388a02f7a4", "observable-f218733a0a70e24df865caf3", "observable-9238c00a570c5784f4afc154" ], "scope": "Query recommendations, not IOC verdicts. Partial provider coverage stays pending; cooldowns/credential failures are not completed checks. Checked means completed attempted direct providers, not all available providers. Review before external disclosure." }, "assessment_sha256": "dc62e368b6df6755c4974fdbfa44cca4c837d0ecedd81aaadc2752a621ade5f0" }, "enrichment": { "items": [ { "type": "ipv4", "value": "91.211.88.122", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.055902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:36.052119+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:36.047053+00:00", "observable_id": "observable-ef5bbf89cf708c774c6a436d" }, { "type": "ipv4", "value": "72.21.81.200", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.712902+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.711029+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:35.708721+00:00", "observable_id": "observable-f4e673c99a1067c26977c12d" }, { "type": "ipv4", "value": "64.4.54.18", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.515524+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.509858+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:35.505133+00:00", "observable_id": "observable-ce72b62e190eaf310460deaf" }, { "type": "ipv4", "value": "52.230.222.68", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.208860+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:35.203701+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:35.198302+00:00", "observable_id": "observable-832b20af9d2129f3f00a68c5" }, { "type": "ipv4", "value": "52.159.17.76", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.969657+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.967164+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:34.964374+00:00", "observable_id": "observable-48f337dfe26d08829c3b46de" }, { "type": "ipv4", "value": "52.114.76.34", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.792358+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.789987+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:34.787384+00:00", "observable_id": "observable-a1b2bf7acdb85461ddd4e318" }, { "type": "ipv4", "value": "52.114.132.22", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.471565+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.465138+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:34.462601+00:00", "observable_id": "observable-3de2ef556760130793de8b99" }, { "type": "ipv4", "value": "52.114.128.9", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.279727+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:34.277861+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:34.275750+00:00", "observable_id": "observable-d3c67a9441beb89e20e85500" }, { "type": "ipv4", "value": "52.109.2.55", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.970989+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.966246+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:33.960503+00:00", "observable_id": "observable-afc88ce283c22562e8d1279c" }, { "type": "ipv4", "value": "52.109.124.20", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.772976+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.768736+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:33.764451+00:00", "observable_id": "observable-5a1306761a23e2137dac2e29" }, { "type": "ipv4", "value": "40.91.116.226", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.505317+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.499772+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:33.494072+00:00", "observable_id": "observable-1c0d3bab70aac371b74597dd" }, { "type": "ipv4", "value": "40.69.216.73", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.120522+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:33.115723+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:33.110747+00:00", "observable_id": "observable-f1fc3cfd7e86d772338a2ddf" }, { "type": "ipv4", "value": "40.126.5.35", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.854694+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.850406+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:32.844941+00:00", "observable_id": "observable-14e6e7c3947eaa6d8bb2c6fd" }, { "type": "ipv4", "value": "23.54.20.139", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.541387+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.537200+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:32.532027+00:00", "observable_id": "observable-7c2732937ce38f94655360b9" }, { "type": "ipv4", "value": "23.54.20.119", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.334182+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.332387+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:32.329929+00:00", "observable_id": "observable-70847d8cc76c81ae595d944a" }, { "type": "ipv4", "value": "23.1.236.92", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.030995+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:32.025890+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:32.019558+00:00", "observable_id": "observable-97584b7141b6c19d191acf3b" }, { "type": "ipv4", "value": "23.1.236.114", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.823972+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.821285+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:31.817620+00:00", "observable_id": "observable-f8f71e1113d06ff1e40410f5" }, { "type": "ipv4", "value": "205.185.216.10", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.619932+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.617309+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:31.613670+00:00", "observable_id": "observable-7cb42e06f57adff2b355999b" }, { "type": "ipv4", "value": "204.79.197.254", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.390735+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.388338+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:31.385438+00:00", "observable_id": "observable-f10db5ad2b4dad781f9e4af1" }, { "type": "ipv4", "value": "204.79.197.222", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.207737+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:31.205042+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:31.202138+00:00", "observable_id": "observable-9a793667f8f456714999a1e6" }, { "type": "ipv4", "value": "204.79.197.200", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.957464+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.952627+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:30.947136+00:00", "observable_id": "observable-db7a8d09200d61729719e21f" }, { "type": "ipv4", "value": "13.107.4.50", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.525720+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.520454+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:30.514849+00:00", "observable_id": "observable-aa07c8df19a0668173d8f158" }, { "type": "ipv4", "value": "13.107.4.254", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.315008+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.312304+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:30.308679+00:00", "observable_id": "observable-0bd65b245da76298a22864a4" }, { "type": "ipv4", "value": "13.107.3.254", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.093827+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:30.089127+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:30.083450+00:00", "observable_id": "observable-b4bef3ae5467e7802293ded1" }, { "type": "ipv4", "value": "13.107.3.128", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.865521+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.861112+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:29.856350+00:00", "observable_id": "observable-193b9306e08a81574d06fc22" }, { "type": "ipv4", "value": "13.107.246.10", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.646359+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.640398+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:29.635312+00:00", "observable_id": "observable-bbba987cdc38be71ecfe574e" }, { "type": "ipv4", "value": "104.77.69.193", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.442450+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.436682+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:29.430345+00:00", "observable_id": "observable-9352bf4fffe94bacc5819799" }, { "type": "domain", "value": "one-hot-mess.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.245822+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.243806+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:29.241636+00:00", "observable_id": "observable-1810e0467b541bfdd2bab449" }, { "type": "domain", "value": "one-hot-mess.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.064922+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:29.060709+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:29.055901+00:00", "observable_id": "observable-a94b2b32b7223853b50e152c" }, { "type": "domain", "value": "one-hot-mess-dc.one-hot-mess.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.798305+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.796217+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:28.793539+00:00", "observable_id": "observable-fecda50588903bb943517377" }, { "type": "domain", "value": "desktop-tzmkhkc.one-hot-mess.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.621090+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.618037+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:28.614002+00:00", "observable_id": "observable-e69367184c4e7a668b9deb14" }, { "type": "domain", "value": "7.tlu.dl.delivery.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.336130+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.333599+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:28.330971+00:00", "observable_id": "observable-e6a1328fcbb2b3cba531392e" }, { "type": "domain", "value": "www.bing.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.166581+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:28.164811+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:28.162733+00:00", "observable_id": "observable-44a03c82ff1877983cebe8f0" }, { "type": "domain", "value": "tsfe.trafficshaping.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.990330+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.988333+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:27.986109+00:00", "observable_id": "observable-910aa7f3a44c175b9b909a54" }, { "type": "domain", "value": "self.events.data.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.827868+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.825495+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:27.823294+00:00", "observable_id": "observable-6e87a09466622f08a1aa83d3" }, { "type": "domain", "value": "s-ring.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.612332+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.610496+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:27.608179+00:00", "observable_id": "observable-b4da2ce053f7692753009c17" }, { "type": "domain", "value": "pti.store.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.440552+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.438140+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:27.434660+00:00", "observable_id": "observable-99789dea42e0a12771b7e662" }, { "type": "domain", "value": "ow1.res.office365.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.254704+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.252079+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:27.248546+00:00", "observable_id": "observable-2637add9a016aa48bbf03342" }, { "type": "domain", "value": "officecdn.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.067622+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:27.059660+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:27.049820+00:00", "observable_id": "observable-cfeb22aa1594a7b22fad8960" }, { "type": "domain", "value": "nexusrules.officeapps.live.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.851269+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.844190+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.838274+00:00", "observable_id": "observable-10556fc0804ab0fbe3417c21" }, { "type": "domain", "value": "mrodevicemgr.officeapps.live.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.666120+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.660910+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.654458+00:00", "observable_id": "observable-4caeed826ff17cc5f3d2ee16" }, { "type": "domain", "value": "login.microsoftonline.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.312021+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.306753+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.301669+00:00", "observable_id": "observable-19d710883d074b712e06d19c" }, { "type": "domain", "value": "kv601.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.122331+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.117068+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.111369+00:00", "observable_id": "observable-e23c94b5a225dafc7d7c6c6c" }, { "type": "domain", "value": "geo.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:21.871597+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.105307+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.097214+00:00", "observable_id": "observable-7064ff870df471c261be7ee8" }, { "type": "domain", "value": "fp.msedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:21.666722+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.090920+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.083733+00:00", "observable_id": "observable-d4fe61ac00ef13a73068254f" }, { "type": "domain", "value": "fp-vp.azureedge.net", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:20.879395+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.076990+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.071418+00:00", "observable_id": "observable-33de7a5adbe981f8b5184ad2" }, { "type": "domain", "value": "fe3cr.delivery.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:18.983978+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.063224+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.056103+00:00", "observable_id": "observable-997b10cc201e2f00c72fbbfb" }, { "type": "domain", "value": "fe2cr.update.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:18.790645+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:26.048028+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:26.041316+00:00", "observable_id": "observable-4e9abe268dc5b27b00f966bd" }, { "type": "domain", "value": "dl.delivery.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.862793+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.860235+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.856751+00:00", "observable_id": "observable-842154a116009726355665e6" }, { "type": "domain", "value": "cp601.prod.do.dsp.mp.microsoft.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.689443+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.687713+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.685442+00:00", "observable_id": "observable-0075d192b861939e9f6b02cf" }, { "type": "domain", "value": "config.edge.skype.com", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:13.482784+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.682958+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.679877+00:00", "observable_id": "observable-f246f830f03a9bac92c2ba70" }, { "type": "domain", "value": "client.wns.windows.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.593714+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:12.580326+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.589794+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.587898+00:00", "observable_id": "observable-d4f7606fe25c93bc00e9118f" }, { "type": "domain", "value": "c-ring.msedge.net", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.587859+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:44:57.151553+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.583410+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.581128+00:00", "observable_id": "observable-2dd4da9939590bf47ce130a1" }, { "type": "domain", "value": "a-ring.msedge.net", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.581095+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": true, "queried_at": "2026-09-22T17:45:09.908536+00:00", "cache_scope": "shared-redis", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.576223+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.573598+00:00", "observable_id": "observable-3bb5fa3eff5e90d80d21b02f" }, { "type": "domain", "value": "2.tlu.dl.delivery.mp.microsoft.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.573554+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.392883+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:25.389787+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:25.386150+00:00", "observable_id": "observable-c349b7dea7701eb5f08b8166" }, { "type": "sha256", "value": "9bfd23273fceb5bb99af6d0d7afebe8ef5c2ae2d0ebb5732a771ef183d2f9c86", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.997696+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.771097+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.765166+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:24.760062+00:00", "observable_id": "observable-e1a13b36dc940a2fe9250f7f" }, { "type": "ipv4", "value": "49.51.172.56", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.759995+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.553763+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.551979+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:24.550162+00:00", "observable_id": "observable-4e2c5d25c852e9d17ce17b95" }, { "type": "ipv4", "value": "205.185.216.42", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.550125+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.244828+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.240855+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:24.237557+00:00", "observable_id": "observable-3650f0f11b426cb85e8d35a3" }, { "type": "domain", "value": "tlu.dl.delivery.mp.microsoft.com", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.237498+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.045988+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.041374+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:24.036207+00:00", "observable_id": "observable-6d098c50ae4766831ba53c1e" }, { "type": "domain", "value": "blueflag.xyz", "signals": [ { "basis": "No verdict: not-applicable", "actors": [], "source": "malwarebazaar", "status": "not-applicable", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:24.036146+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.864167+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.862341+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:23.860278+00:00", "observable_id": "observable-e398b99b7298c2051a7515bf" }, { "type": "sha256", "value": "03c962ebb541a709b92957e301ea03f1790b6a57d4d0605f618fb0be392c8066", "signals": [ { "basis": "No verdict: not_found", "actors": [], "source": "malwarebazaar", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.486307+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: not_found", "actors": [], "source": "threatfox", "status": "not_found", "verdict": "unknown", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.274349+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } }, { "basis": "No verdict: deferred-rate-limit", "actors": [], "source": "virustotal", "status": "deferred-rate-limit", "verdict": "unknown", "retry_at": "2026-09-22T17:49:29.781117+00:00", "cache_hit": false, "queried_at": "2026-09-22T17:45:23.271538+00:00", "technique_ids": [], "context_status": "provider-assertion-not-capture-behavior-or-attribution", "cooldown_scope": "shared-redis", "error_category": "rate_limited", "relationship_context": [], "evidence_source_sha256": "44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a", "evidence": { "records": [], "public_note": "Bounded provider summary, not a redistribution of the complete response." } } ], "queried_at": "2026-09-22T17:45:23.268210+00:00", "observable_id": "observable-68d84fd3015161cf881a1bb5" } ], "coverage": { "cache_hits": 0, "active_scans": 0, "batch_results": [ { "status": "deferred-rate-limit", "provider": "virustotal", "observable_id": "observable-ef5bbf89cf708c774c6a436d" }, { "status": "not_found", "provider": "threatfox", "observable_id": "observable-ef5bbf89cf708c774c6a436d" } ], "batch_targets": 1, "payload_uploads": 0, "targets_omitted": 0, "retained_targets": 61, "full_urls_disclosed": 0, "provider_lookups_started": 1 }, "updated_at": "2026-09-22T17:45:36.250079+00:00", "schema_version": "pcap-reputation-v1", "snapshot_sha256": "cf2d4c3bb8c2bbb049d56945f2458679b410937b6395af4af60e6ba16c7bdc62", "source_semantic_sha256": "6fc7d6e1a73357c382b6269858c45faf638a8c9f52816c64ae733c965cb7611b", "previous_snapshot_sha256": "b0908c1fc34dc41add2a03a72620d67198b93c7df14422fe79e00200d12a9225" }, "artifact_download_available": true, "source_tlp": "TLP:CLEAR", "techniques": [], "apt_matches": [], "public_note": "Public derivative: full packet extraction retained; provider evidence bounded; other-session details omitted. Original snapshot hashes do not hash this serialized derivative." }